@@ -1009,6 +1009,19 @@ Full table: [Docker Guide — runtime RAM](docs/guides/DOCKER_GUIDE.md#runtime-r
> are **not supported for production**. See
> [Docker Release Channels](docs/guides/DOCKER_GUIDE.md#release-channels).
+**🥟 Bun**
+
+Standard `bun install` and global installation (`bun install -g omniroute`) are supported via Bun runtime detection:
+- **Built-in `bun:sqlite`**: OmniRoute uses Bun's built-in `bun:sqlite` driver when running under Bun, falling back to `better-sqlite3` on Node.js or `sql.js`.
+- **Automatic Webpack bundler selection**: Development (`bun run dev`) and production builds (`bun run build`) automatically detect Bun and disable Turbopack in favor of Webpack to prevent native V8 binding incompatibilities.
+- **Dedicated Bun Dockerfile**: Multi-stage `Dockerfile.bun` for native Bun production deployments (`docker build -f Dockerfile.bun -t omniroute:bun .`).
+
+```bash
+# Install and run with Bun
+bun install
+bun run dev
+```
+
**🛠️ From source**
```bash
@@ -1187,7 +1200,7 @@ Métricas de validação: 1002 vídeos rastreados · 7,069,190 visualizações c
Runtime Node.js 22.x / 24.x LTS — >=22.22.2 <23 || >=24.0.0 <27 Language TypeScript 6.0 — 100% TypeScript across src/ and open-sse/ (zero any in core since v2.0) Framework Next.js 16 + React 19 + Tailwind CSS 4
-
Database better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 120 domain modules, 157 migrations
+
Database better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 120 domain modules, 159 migrations Memory SQLite FTS5 full-text + int8-quantized vector embeddings, typed decay Schemas Zod 4 — MCP tool I/O validation + API contracts Protocols MCP (stdio / HTTP / SSE) + A2A v0.3 (JSON-RPC 2.0 + SSE)
diff --git a/bin/cli/commands/combo.mjs b/bin/cli/commands/combo.mjs
index 554c1c1d838c..8d58cf73bd93 100644
--- a/bin/cli/commands/combo.mjs
+++ b/bin/cli/commands/combo.mjs
@@ -307,6 +307,12 @@ export async function runComboCreateCommand(name, strategy = "priority", opts =
}
const models = Array.isArray(opts.models) ? opts.models : [];
+ if (!models.length) {
+ console.error(
+ "combo create requires at least one target. Pass --models
and/or repeat --model ."
+ );
+ return 1;
+ }
try {
return await withRuntime(async ({ kind, api, db }) => {
diff --git a/bin/cli/commands/oauth.mjs b/bin/cli/commands/oauth.mjs
index 8bf547b2c00f..c9f8386d2b9d 100644
--- a/bin/cli/commands/oauth.mjs
+++ b/bin/cli/commands/oauth.mjs
@@ -228,20 +228,38 @@ async function runSocialFlow(def, opts) {
async function runDeviceFlow(def, opts) {
const providerKey = resolveBackendKey(def.id);
- const startRes = await apiFetch(`/api/providers/${providerKey}/auth/start`, {
- ...targetApiOptions(opts),
- method: "POST",
- });
+ let startRes = await apiFetch(`/api/oauth/${providerKey}/device-code`, targetApiOptions(opts));
+ if (!startRes.ok) {
+ startRes = await apiFetch(`/api/providers/${providerKey}/auth/start`, {
+ ...targetApiOptions(opts),
+ method: "POST",
+ });
+ }
if (!startRes.ok) {
process.stderr.write(`Failed to start device flow: ${startRes.status}\n`);
process.exit(1);
}
const start = await startRes.json();
- process.stdout.write(
- `\nDevice code: ${start.userCode ?? start.user_code ?? ""}\nVisit: ${start.verificationUri ?? start.verification_uri}\n\n`
- );
- if (opts.browser !== false)
- await openBrowser(start.verificationUri ?? start.verification_uri ?? "");
+ const userCode = start.userCode ?? start.user_code ?? "";
+ const verificationUri =
+ start.verificationUriComplete ??
+ start.verification_uri_complete ??
+ start.verificationUri ??
+ start.verification_uri ??
+ start.authUrl ??
+ start.url ??
+ "";
+
+ if (userCode) {
+ process.stdout.write(`\nDevice code: ${userCode}\nVisit: ${verificationUri}\n\n`);
+ } else if (verificationUri) {
+ process.stdout.write(`\nVisit: ${verificationUri}\n\n`);
+ } else {
+ process.stdout.write(`\nAuthorization URL not available\n\n`);
+ }
+
+ if (opts.browser !== false && verificationUri)
+ await openBrowser(verificationUri);
process.stderr.write("Waiting for device authorization...\n");
const deadline = Date.now() + (opts.timeout ?? 300000);
const intervalMs = (start.intervalMs ?? start.interval ?? 5) * 1000;
diff --git a/bin/cli/commands/plugin.mjs b/bin/cli/commands/plugin.mjs
index fc433a88ea4e..971c9ef231b2 100644
--- a/bin/cli/commands/plugin.mjs
+++ b/bin/cli/commands/plugin.mjs
@@ -9,10 +9,13 @@ import { discoverPlugins } from "../plugins.mjs";
// (instead of string-interpolating into `execSync`) prevents a malicious plugin
// name like `foo; rm -rf ~` or `` foo`id` `` from being interpreted by the shell.
function runNpm(args) {
- const res = spawnSync("npm", args, { stdio: "inherit", shell: false });
+ const isBun = Boolean(process.versions.bun);
+ const pm = isBun ? "bun" : "npm";
+ const cmdArgs = isBun && args[0] === "install" ? ["add", ...args.slice(1)] : args;
+ const res = spawnSync(pm, cmdArgs, { stdio: "inherit", shell: false });
if (res.error) throw res.error;
if (typeof res.status === "number" && res.status !== 0) {
- throw new Error(`npm exited with code ${res.status}`);
+ throw new Error(`${pm} exited with code ${res.status}`);
}
}
diff --git a/bin/cli/runtime/nativeDeps.mjs b/bin/cli/runtime/nativeDeps.mjs
index 60e4d2195312..ba5274f3c6a4 100644
--- a/bin/cli/runtime/nativeDeps.mjs
+++ b/bin/cli/runtime/nativeDeps.mjs
@@ -114,30 +114,30 @@ export function isBetterSqliteBinaryValid() {
export function npmInstallRuntime(pkgs, opts = {}) {
const cwd = ensureRuntimeDir();
- // Persist to the runtime package.json (exact version) instead of --no-save so a later
- // install of a sibling runtime dep (e.g. systray2 from trayRuntime.ts, which writes to the
- // same runtime dir) does not prune this package as "extraneous" — that pruning otherwise
- // reproduces "No SQLite driver available" after a tray install removes better-sqlite3.
- // npm 12+ defaults `allowScripts` to off, silently skipping lifecycle/install
- // scripts (e.g. better-sqlite3's node-gyp/prebuild-install rebuild) unless the
- // package has a matching `allowScripts` entry — and still exits 0, masking the
- // failure (#10713). The runtime dir is a CLI-owned, non-user package.json, so
- // explicitly allowing scripts for the packages we are installing here is safe.
- const npmArgs = [
- "install",
- ...pkgs,
- "--no-audit",
- "--no-fund",
- "--prefer-online",
- "--save-exact",
- ...pkgs.map((pkg) => `--allow-scripts=${pkg}`),
- ];
- // On Windows .cmd files cannot be executed without a shell; use cmd.exe /c explicitly
- // so we never set shell:true (which would propagate env and enable injection).
const isWin = platform() === "win32";
- const [exe, args] = isWin ? ["cmd.exe", ["/c", "npm", ...npmArgs]] : ["npm", npmArgs];
+ const isBun = Boolean(process.versions.bun);
+
+ let exe, args, displayCmd;
+ if (isBun) {
+ const bunArgs = ["add", ...pkgs, "--trust"];
+ [exe, args] = isWin ? ["cmd.exe", ["/c", "bun", ...bunArgs]] : ["bun", bunArgs];
+ displayCmd = `bun ${bunArgs.join(" ")}`;
+ } else {
+ const npmArgs = [
+ "install",
+ ...pkgs,
+ "--no-audit",
+ "--no-fund",
+ "--prefer-online",
+ "--save-exact",
+ ...pkgs.map((pkg) => `--allow-scripts=${pkg}`),
+ ];
+ [exe, args] = isWin ? ["cmd.exe", ["/c", "npm", ...npmArgs]] : ["npm", npmArgs];
+ displayCmd = `npm ${npmArgs.join(" ")}`;
+ }
+
if (!opts.silent) {
- process.stdout.write(`[omniroute][runtime] npm ${npmArgs.join(" ")}\n`);
+ process.stdout.write(`[omniroute][runtime] ${displayCmd}\n`);
}
const res = spawnSync(exe, args, {
cwd,
diff --git a/bin/cli/sqlite.mjs b/bin/cli/sqlite.mjs
index ce14541480fb..982fef3520af 100644
--- a/bin/cli/sqlite.mjs
+++ b/bin/cli/sqlite.mjs
@@ -5,10 +5,14 @@ import { ensureSettingsSchema, hashManagementPassword, updateSettings } from "./
async function loadSqlite() {
if (process.versions.bun) {
- return { Database: (await import("bun:sqlite")).Database };
+ try {
+ return { Database: (await import("bun:sqlite")).Database, driver: "bun:sqlite" };
+ } catch (bunError) {
+ // fall through to better-sqlite3 if bun:sqlite fails
+ }
}
try {
- return { Database: (await import("better-sqlite3")).default };
+ return { Database: (await import("better-sqlite3")).default, driver: "better-sqlite3" };
} catch (error) {
return { error };
}
@@ -86,12 +90,14 @@ export function normalizeBunSqliteParams(params) {
export function createSqliteNativeError(error) {
const message = error instanceof Error ? error.message : String(error);
+ const isBun = Boolean(process.versions.bun);
+ const rebuildCmd = isBun ? "bun add better-sqlite3 --trust" : "npm rebuild better-sqlite3";
if (message.includes("NODE_MODULE_VERSION") || message.includes("ERR_DLOPEN_FAILED")) {
return new Error(
- "better-sqlite3 native binding is incompatible with this Node.js runtime. " +
- "Run `npm rebuild better-sqlite3` in the OmniRoute project and try again. " +
- "Or run: omniroute runtime repair " +
- "(rebuilds into a user-writable runtime; works without a C++ toolchain)."
+ `better-sqlite3 native binding is incompatible with this runtime. ` +
+ `Run \`${rebuildCmd}\` in the OmniRoute project and try again. ` +
+ `Or run: omniroute runtime repair ` +
+ `(rebuilds into a user-writable runtime; works without a C++ toolchain).`
);
}
if (
@@ -100,10 +106,9 @@ export function createSqliteNativeError(error) {
message.includes("Cannot find module 'better-sqlite3'")
) {
return new Error(
- "better-sqlite3 native binding could not be found (no prebuilt addon for this platform). " +
- "This is common under `npx`, which runs a fresh, ephemeral install that never built the addon. " +
- "Run: omniroute runtime repair " +
- "(rebuilds into a user-writable runtime; works without a C++ toolchain)."
+ `better-sqlite3 native binding could not be found (no prebuilt addon for this platform). ` +
+ `Run: omniroute runtime repair ` +
+ `(rebuilds into a user-writable runtime; works without a C++ toolchain).`
);
}
return error;
@@ -111,7 +116,7 @@ export function createSqliteNativeError(error) {
async function openSqliteDatabase(dbPath, options = {}) {
const loaded = await loadSqlite();
- if (process.versions.bun) {
+ if (loaded.driver === "bun:sqlite" || (process.versions.bun && !loaded.Database)) {
if (options.fileMustExist && !fs.existsSync(dbPath)) {
throw new Error(`SQLite file does not exist: ${dbPath}`);
}
diff --git a/bin/cli/utils/ensureAndroidCacheDir.mjs b/bin/cli/utils/ensureAndroidCacheDir.mjs
index 30fe073f8b4f..0e3f2d20ec41 100644
--- a/bin/cli/utils/ensureAndroidCacheDir.mjs
+++ b/bin/cli/utils/ensureAndroidCacheDir.mjs
@@ -94,10 +94,15 @@ export function ensureAndroidCacheDir(options = {}) {
*/
export function isFatalInstrumentationHookFailure(text) {
if (!text) return false;
- return (
- /Unsupported platform:\s*android/i.test(text) ||
- /error occurred while loading instrumentation hook/i.test(text)
- );
+ // Next.js wraps ANY throw inside instrumentation.register() with the generic
+ // "An error occurred while loading instrumentation hook:" prefix, on every
+ // platform (node_modules/next/dist/server/web/globals.js). That prefix alone
+ // therefore cannot identify the Android/Termux cache-probe failure — a bare
+ // generic instrumentation error on win32/desktop would be misreported as the
+ // Android bug and hide the real cause. Only match when the text actually
+ // carries the Android platform marker that Next's getCacheDirectory() emits.
+ // #10028
+ return /Unsupported platform:\s*android/i.test(text);
}
/**
diff --git a/bin/nodeRuntimeSupport.mjs b/bin/nodeRuntimeSupport.mjs
index 47905f0e4ff7..8f8f88f68327 100644
--- a/bin/nodeRuntimeSupport.mjs
+++ b/bin/nodeRuntimeSupport.mjs
@@ -44,6 +44,18 @@ export function getSecureFloorForMajor(major) {
}
export function getNodeRuntimeSupport(version = process.versions.node) {
+ if (process.versions.bun) {
+ return {
+ nodeVersion: `bun-${process.versions.bun} (Node.js API ${version})`,
+ nodeCompatible: true,
+ reason: "supported-bun",
+ supportedRange: SUPPORTED_NODE_RANGE + " || Bun >=1.1.0",
+ supportedDisplay: SUPPORTED_NODE_DISPLAY + ", or Bun 1.1+",
+ recommendedVersion: `v${RECOMMENDED_NODE_VERSION}`,
+ minimumSecureVersion: null,
+ };
+ }
+
const parsed = parseNodeVersion(version);
const secureFloor = getSecureFloorForMajor(parsed.major);
const nodeCompatible = secureFloor ? compareNodeVersions(parsed, secureFloor) >= 0 : false;
diff --git a/bin/omniroute.mjs b/bin/omniroute.mjs
index fb0a4555208e..09b133df4f3b 100755
--- a/bin/omniroute.mjs
+++ b/bin/omniroute.mjs
@@ -17,7 +17,12 @@
import { existsSync, readFileSync, writeFileSync } from "node:fs";
import { join, dirname } from "node:path";
import { fileURLToPath, pathToFileURL } from "node:url";
-import updateNotifier from "update-notifier";
+let updateNotifier = null;
+try {
+ updateNotifier = (await import("update-notifier")).default;
+} catch {
+ // update-notifier is optional in pruned standalone environments
+}
import { isNativeBinaryCompatible } from "../scripts/build/native-binary-compat.mjs";
import { getNodeRuntimeSupport, getNodeRuntimeWarning } from "./nodeRuntimeSupport.mjs";
import { getDefaultDataDir } from "./cli/data-dir.mjs";
@@ -251,8 +256,9 @@ if (shouldProvisionStorageKey(process.argv)) {
// Register update notifier — checks npm once per 24h, notifies on exit via stderr.
const _pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
-const _notifier = updateNotifier({ pkg: _pkg, updateCheckInterval: 1000 * 60 * 60 * 24 });
+const _notifier = updateNotifier ? updateNotifier({ pkg: _pkg, updateCheckInterval: 1000 * 60 * 60 * 24 }) : null;
process.on("exit", () => {
+ if (!_notifier || !_notifier.update) return;
if (process.env.OMNIROUTE_NO_UPDATE_NOTIFIER) return;
if (process.env.CI) return;
if (process.argv.includes("--quiet") || process.argv.includes("-q")) return;
diff --git a/changelog.d/features/11104-operator-error-rules.md b/changelog.d/features/11104-operator-error-rules.md
new file mode 100644
index 000000000000..f31e78c01f3e
--- /dev/null
+++ b/changelog.d/features/11104-operator-error-rules.md
@@ -0,0 +1 @@
+- **feat(providers):** let operators declare per-provider error rules through `settings.providerErrorRules` instead of patching the catalog — an operator-supplied rule for a provider is consulted before the built-in `providerRuleRegistry`, receives the raw error text, and has its declared scope/cooldown/reason actually honored end to end, for any provider (declaring the rule is the opt-in — no extra allowlist entry needed). Matches are plain case-insensitive substrings (never RegExp) and bounded to 50 rules to keep the hot path safe ([#11104](https://github.com/diegosouzapw/OmniRoute/pull/11104))
diff --git a/changelog.d/features/11190-usage-command-json.md b/changelog.d/features/11190-usage-command-json.md
new file mode 100644
index 000000000000..d7655f04c51b
--- /dev/null
+++ b/changelog.d/features/11190-usage-command-json.md
@@ -0,0 +1 @@
+- **feat(api):** `/api/usage/om-usage` gains a structured form — `?format=json` returns the key's own usage as `ApiKeyUsageLimitStatus` + `UsageSnapshot` instead of `text/plain`. This is the surface a UI (the OmniCopilot panel) consumes to show a key holder their daily/weekly spend and quota reset. The route is self-service (the caller's own key, gated by `allowUsageCommand`), not the management surface; refusals come back as a discriminated `{ "allowed": false, "error": … }` so a UI can tell "not allowed" apart from "allowed but nothing cached yet". The endpoint was previously undocumented in `API_REFERENCE.md`; it now has a section ([#11190](https://github.com/diegosouzapw/OmniRoute/pull/11190))
diff --git a/changelog.d/features/11192-usage-command-providers-array.md b/changelog.d/features/11192-usage-command-providers-array.md
new file mode 100644
index 000000000000..b7ef42110913
--- /dev/null
+++ b/changelog.d/features/11192-usage-command-providers-array.md
@@ -0,0 +1 @@
+- **feat(api):** `/api/usage/om-usage?format=json` now returns `providers[]` — every connection's quota snapshot, not just the single selected one — so a panel can render Codex / Claude / OpenCode side by side. The collector already gathered all of them; the single-pick `provider` field (kept) is a terminal presentation choice. Closes the per-connection gap from OmniCopilot #8 ([#11192](https://github.com/diegosouzapw/OmniRoute/pull/11192))
diff --git a/changelog.d/fixes/10028-windows-instrumentation-hook.md b/changelog.d/fixes/10028-windows-instrumentation-hook.md
new file mode 100644
index 000000000000..9879e2f3f303
--- /dev/null
+++ b/changelog.d/fixes/10028-windows-instrumentation-hook.md
@@ -0,0 +1 @@
+- fix(cli): stop diagnosing every Next.js instrumentation-hook failure as the Android/Termux cache bug — only the Android "Unsupported platform: android" signal now triggers the Android hint, so a win32/desktop instrumentation error surfaces its real cause instead of a useless `mkdir -p ~/.cache` (#10028)
\ No newline at end of file
diff --git a/changelog.d/fixes/10265-command-code-provider-api.md b/changelog.d/fixes/10265-command-code-provider-api.md
new file mode 100644
index 000000000000..b38e4e9d2a50
--- /dev/null
+++ b/changelog.d/fixes/10265-command-code-provider-api.md
@@ -0,0 +1 @@
+- fix(command-code): route chat to the documented /provider/v1/chat/completions endpoint instead of the CLI-only /alpha/generate, which Command Code gates/blocks for external callers (#10265)
\ No newline at end of file
diff --git a/changelog.d/fixes/10523-servicesupervisor-port-flake.md b/changelog.d/fixes/10523-servicesupervisor-port-flake.md
new file mode 100644
index 000000000000..1a98ea7fa288
--- /dev/null
+++ b/changelog.d/fixes/10523-servicesupervisor-port-flake.md
@@ -0,0 +1 @@
+- fix(services): isolate probeBeforeSpawn adoption tests on distinct ports to stop the order-dependent flake (#10523)
\ No newline at end of file
diff --git a/changelog.d/fixes/10550-responses-reasoning-transport.md b/changelog.d/fixes/10550-responses-reasoning-transport.md
index d34c433debd8..e2b40cdb8c97 100644
--- a/changelog.d/fixes/10550-responses-reasoning-transport.md
+++ b/changelog.d/fixes/10550-responses-reasoning-transport.md
@@ -1 +1 @@
-- Preserve portable plaintext reasoning by default across streaming and non-streaming Chat Completions and Responses routes while keeping provider-bound opaque state target-compatible. Combos now drop incompatible continuation reasoning by default and can explicitly skip incompatible targets, while known providers no longer show redundant encrypted-reasoning controls. (#10550)
+- Preserve portable plaintext reasoning by default across streaming and non-streaming Chat Completions and Responses routes while keeping provider-bound opaque state target-compatible. Direct requests drop incompatible continuation reasoning by default; combos can explicitly skip incompatible targets without mutating the request. Known providers no longer show redundant encrypted-reasoning controls. (#10550, #10959)
diff --git a/changelog.d/fixes/10949-mixed-reasoning-plaintext.md b/changelog.d/fixes/10949-mixed-reasoning-plaintext.md
new file mode 100644
index 000000000000..05a055ec5384
--- /dev/null
+++ b/changelog.d/fixes/10949-mixed-reasoning-plaintext.md
@@ -0,0 +1 @@
+- Preserve explicit plaintext reasoning when a Responses reasoning item also carries opaque provider state (rare OpenCode Go `deepseek-v4-flash` responses). Mixed plaintext + opaque input is projected onto the target transport: plaintext targets keep portable text, opaque targets keep provider state. Opaque-only reasoning is dropped when the selected target cannot replay it, allowing cross-model conversations to continue. (#10949, #10959)
diff --git a/changelog.d/fixes/10986-reasoning-only-content.md b/changelog.d/fixes/10986-reasoning-only-content.md
new file mode 100644
index 000000000000..0d293482bd30
--- /dev/null
+++ b/changelog.d/fixes/10986-reasoning-only-content.md
@@ -0,0 +1 @@
+- fix(command-code): surface reasoning-only output as content when a model emits no text-delta (#10986)
\ No newline at end of file
diff --git a/changelog.d/fixes/10990-v0-vercel-web-static-catalog.md b/changelog.d/fixes/10990-v0-vercel-web-static-catalog.md
new file mode 100644
index 000000000000..9d5672120802
--- /dev/null
+++ b/changelog.d/fixes/10990-v0-vercel-web-static-catalog.md
@@ -0,0 +1 @@
+- **Static model catalog for v0-vercel-web:** seed a static catalog for the v0-vercel-web web-cookie provider (v0-1.0-md, v0-1.5-lg, v0-1.5-md) so its dashboard "Available Models" / "Import from /models" UI serves a usable list instead of falling through to the route's 400 "does not support models listing" ([#10990](https://github.com/diegosouzapw/OmniRoute/issues/10990)).
\ No newline at end of file
diff --git a/changelog.d/fixes/10997-blackbox-deprecation.md b/changelog.d/fixes/10997-blackbox-deprecation.md
new file mode 100644
index 000000000000..74ac19152673
--- /dev/null
+++ b/changelog.d/fixes/10997-blackbox-deprecation.md
@@ -0,0 +1 @@
+- fix(providers): mark the blackbox provider deprecated — api.blackbox.ai returns HTTP 404 on every path variant (sweep 2026-08-21), so the public inference surface is dead and the catalog entry now carries a deprecation notice. ([#10997](https://github.com/diegosouzapw/OmniRoute/issues/10997))
\ No newline at end of file
diff --git a/changelog.d/fixes/11002-dify-key-validation.md b/changelog.d/fixes/11002-dify-key-validation.md
new file mode 100644
index 000000000000..6574714c9be6
--- /dev/null
+++ b/changelog.d/fixes/11002-dify-key-validation.md
@@ -0,0 +1 @@
+- fix(providers): validate Dify keys against its native /v1/chat-messages endpoint (#11002)
\ No newline at end of file
diff --git a/changelog.d/fixes/11015-shutdown-track-sse.md b/changelog.d/fixes/11015-shutdown-track-sse.md
new file mode 100644
index 000000000000..1ed99b3669d8
--- /dev/null
+++ b/changelog.d/fixes/11015-shutdown-track-sse.md
@@ -0,0 +1 @@
+- **fix(resilience):** count heavyweight `/v1` admission leases in the SIGTERM drain and send `Retry-After` on shutdown 503s so Recreate no longer looks like an empty 502 ([#11015](https://github.com/diegosouzapw/OmniRoute/issues/11015)) — thanks @RaviTharuma
diff --git a/changelog.d/fixes/11050-remove-ghost-webhook-events.md b/changelog.d/fixes/11050-remove-ghost-webhook-events.md
new file mode 100644
index 000000000000..6278ee6c0a93
--- /dev/null
+++ b/changelog.d/fixes/11050-remove-ghost-webhook-events.md
@@ -0,0 +1 @@
+- **fix(webhooks):** remove 3 declared-but-never-emitted events (`provider.error`, `provider.recovered`, `combo.switched`) from `WebhookEvent` — catalog now `request.completed | request.failed | quota.exceeded | test.ping`; `POST /api/webhooks` and `PUT /api/webhooks/[id]` reject ghost values with 400; OpenAPI webhook description updated across 43 locales ([11050](https://github.com/diegosouzapw/OmniRoute/pull/11050))
diff --git a/changelog.d/fixes/11060-perplexity-filter.md b/changelog.d/fixes/11060-perplexity-filter.md
new file mode 100644
index 000000000000..c221d3ccaba1
--- /dev/null
+++ b/changelog.d/fixes/11060-perplexity-filter.md
@@ -0,0 +1 @@
+- fix(providers): filter Perplexity model import to the Sonar family so Agent-API catalog ids stop surfacing as routable chat models (#11060)
diff --git a/changelog.d/fixes/11085-claude-code-tool-name-casing.md b/changelog.d/fixes/11085-claude-code-tool-name-casing.md
new file mode 100644
index 000000000000..5ad424c14182
--- /dev/null
+++ b/changelog.d/fixes/11085-claude-code-tool-name-casing.md
@@ -0,0 +1 @@
+- **fix(claude):** restore canonical tool names (`bash` → `Bash`, `croncreate` → `CronCreate`) on non-streaming OpenAI→Claude conversion and through identity-echo alias maps, so Claude Code stops rejecting tool calls with "No such tool available" ([#11085](https://github.com/diegosouzapw/OmniRoute/pull/11085)) — thanks @linhdmn
diff --git a/changelog.d/fixes/11095-termux-onnx.md b/changelog.d/fixes/11095-termux-onnx.md
new file mode 100644
index 000000000000..8c268037104c
--- /dev/null
+++ b/changelog.d/fixes/11095-termux-onnx.md
@@ -0,0 +1 @@
+- fix(install): make the ONNX dependency chain optional so Termux/Android installs succeed again (#11095)
diff --git a/changelog.d/fixes/11101-reject-silent-validation.md b/changelog.d/fixes/11101-reject-silent-validation.md
new file mode 100644
index 000000000000..04b2a67d5a07
--- /dev/null
+++ b/changelog.d/fixes/11101-reject-silent-validation.md
@@ -0,0 +1 @@
+- **fix(providers):** Reject silent validation degradation on provider connection patch — unknown `rateLimitOverrides` keys (e.g. a typo'd `tpm`) and empty/non-numeric values now return `400` with the rejected key list instead of being silently dropped ([#11101](https://github.com/diegosouzapw/OmniRoute/pull/11101))
diff --git a/changelog.d/fixes/11102-combo-suggestion-count.md b/changelog.d/fixes/11102-combo-suggestion-count.md
new file mode 100644
index 000000000000..3cbf6f11d3de
--- /dev/null
+++ b/changelog.d/fixes/11102-combo-suggestion-count.md
@@ -0,0 +1 @@
+- **Autopilot suggestion counter:** the combo health autopilot summary now reports `suggestionCount` (the real number of suggested actions across all issues) instead of conflating it with link counts, while keeping `actionableCount` as a deprecated alias for backward compatibility. The `run_combo_test` action now links to the dashboard with the combo id (`/dashboard/combos?test=`) rather than the read-only API route, so operators can actually trigger a test from the UI ([#11102](https://github.com/diegosouzapw/OmniRoute/pull/11102)).
diff --git a/changelog.d/fixes/11103-persist-config-audit-log.md b/changelog.d/fixes/11103-persist-config-audit-log.md
new file mode 100644
index 000000000000..aeb53b178145
--- /dev/null
+++ b/changelog.d/fixes/11103-persist-config-audit-log.md
@@ -0,0 +1 @@
+- **Config audit persistence:** persist the configuration audit trail to SQLite (`config_audit_log`) instead of an in-memory buffer capped at 1000 volatile entries, and bound its growth with `cleanupConfigAudit()` driven by the `retention.configAudit` setting (default 30 days), wired into `runAutoCleanup` ([#11103](https://github.com/diegosouzapw/OmniRoute/pull/11103)).
diff --git a/changelog.d/fixes/11109-stream-recovery-toolcall.md b/changelog.d/fixes/11109-stream-recovery-toolcall.md
new file mode 100644
index 000000000000..04a43382e427
--- /dev/null
+++ b/changelog.d/fixes/11109-stream-recovery-toolcall.md
@@ -0,0 +1 @@
+- fix(sse): resume mid-stream recovery after a _completed_ tool call — `finish_reason: "tool_calls"` is now tracked per-call instead of as a general terminal marker, so truncation of trailing prose after a fully-delivered tool call is recoverable while in-flight calls stay blocked ([#11109](https://github.com/diegosouzapw/OmniRoute/pull/11109))
diff --git a/changelog.d/fixes/11116-reasoning-effort-capability-discovery.md b/changelog.d/fixes/11116-reasoning-effort-capability-discovery.md
new file mode 100644
index 000000000000..fbc4dfe694e3
--- /dev/null
+++ b/changelog.d/fixes/11116-reasoning-effort-capability-discovery.md
@@ -0,0 +1 @@
+- **fix(providers):** `reasoning_effort` now learns the accepted values from a provider's own 400/422 response and clamps to the highest one instead of forwarding an unsupported `xhigh`/`max` (or a hardcoded `"high"` fallback) — fixes custom OpenAI-compatible connections and registered providers with no reasoning metadata ([#11116](https://github.com/diegosouzapw/OmniRoute/pull/11116)) — thanks @maxmad64bis
diff --git a/changelog.d/fixes/11144-responses-parallel-tool-calls-index.md b/changelog.d/fixes/11144-responses-parallel-tool-calls-index.md
new file mode 100644
index 000000000000..35ba19b27960
--- /dev/null
+++ b/changelog.d/fixes/11144-responses-parallel-tool-calls-index.md
@@ -0,0 +1 @@
+- **fix(sse):** parallel `function_call` items in a Responses API stream (e.g. several tool calls dispatched in the same turn) now each get a stable, distinct `index`/`id` when translated to Chat Completions streaming deltas, instead of colliding on index 0 and tripping strict stream parsers with `Expected 'id' to be a string.` ([#11144](https://github.com/diegosouzapw/OmniRoute/pull/11144))
diff --git a/changelog.d/fixes/11154-provider-registry-node-net-bundle.md b/changelog.d/fixes/11154-provider-registry-node-net-bundle.md
new file mode 100644
index 000000000000..b30d9e139265
--- /dev/null
+++ b/changelog.d/fixes/11154-provider-registry-node-net-bundle.md
@@ -0,0 +1 @@
+- fix(dashboard): keep `open-sse/config/providerRegistry.ts` free of `node:net` so the provider detail client bundle builds again — the host classification moved to a platform-free `src/shared/network/privateHost.ts` with a pure-JS `isIP` equivalent, leaving the #11122 routing behaviour unchanged (#11154)
diff --git a/changelog.d/fixes/11162-combo-create-requires-model.md b/changelog.d/fixes/11162-combo-create-requires-model.md
new file mode 100644
index 000000000000..228e6a9b20f8
--- /dev/null
+++ b/changelog.d/fixes/11162-combo-create-requires-model.md
@@ -0,0 +1 @@
+- **Combo create:** creating a routing combo without any model is now refused (`400`) — the CLI requires `--models`/`--model` on `combo create`, matching the dashboard which already rejected empty combos.
diff --git a/changelog.d/fixes/11165-shared-registry-passthrough-model-lockout.md b/changelog.d/fixes/11165-shared-registry-passthrough-model-lockout.md
new file mode 100644
index 000000000000..eabe67cb09cb
--- /dev/null
+++ b/changelog.d/fixes/11165-shared-registry-passthrough-model-lockout.md
@@ -0,0 +1 @@
+- **fix(resilience):** a missing-model `404` on a provider that declares `passthroughModels: true` in the shared registry (novita, uncloseai, orcarouter and 37 others) now locks out only that model instead of cooling the entire connection — `hasPerModelQuota()` previously read only the open-sse registry and the local/self-hosted families ([#11165](https://github.com/diegosouzapw/OmniRoute/pull/11165)) — thanks @yourspraveen
diff --git a/changelog.d/fixes/8864-uncloseai-noauth.md b/changelog.d/fixes/8864-uncloseai-noauth.md
new file mode 100644
index 000000000000..8a38e6b8363c
--- /dev/null
+++ b/changelog.d/fixes/8864-uncloseai-noauth.md
@@ -0,0 +1 @@
+- fix(dashboard): treat UncloseAI as a no-auth provider so the connect form no longer forces a fake API key (#8864)
diff --git a/changelog.d/fixes/9123-search-provider-local-flag-guard-mismatch.md b/changelog.d/fixes/9123-search-provider-local-flag-guard-mismatch.md
new file mode 100644
index 000000000000..bc51e121036b
--- /dev/null
+++ b/changelog.d/fixes/9123-search-provider-local-flag-guard-mismatch.md
@@ -0,0 +1 @@
+- fix(ssrf): make `getProviderOutboundGuard()` (used for search-provider connection validation, image generation and remote image fetch) honor the local-first default `OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS` the same way the chat validation guard already does, so a LAN-hosted SearXNG/Brave search provider works with only the LOCAL flag set instead of silently requiring `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS` ([#9123](https://github.com/diegosouzapw/OmniRoute/issues/9123)).
\ No newline at end of file
diff --git a/changelog.d/fixes/pending-opencode-empty-rejection-rotation.md b/changelog.d/fixes/pending-opencode-empty-rejection-rotation.md
new file mode 100644
index 000000000000..82a88c5905a7
--- /dev/null
+++ b/changelog.d/fixes/pending-opencode-empty-rejection-rotation.md
@@ -0,0 +1 @@
+- **fix(executors):** OpencodeExecutor rotates (or retries once on a single-account direct path) on upstream 400 empty-body rejections — malformed completion envelopes with no error field were propagated as success and killed client sessions. Bounded +1 attempt per request; body reads are conditioned on status 400 so successful/streaming responses are never buffered. 400s carrying an error field keep propagating immediately.
diff --git a/changelog.d/fixes/release-v3850-basereds-tests-i18n.md b/changelog.d/fixes/release-v3850-basereds-tests-i18n.md
new file mode 100644
index 000000000000..3a6dee61b9cd
--- /dev/null
+++ b/changelog.d/fixes/release-v3850-basereds-tests-i18n.md
@@ -0,0 +1 @@
+- fix(i18n): complete Vietnamese translations for recently added UI strings (#9985)
diff --git a/changelog.d/fixes/release-v3850-basereds.md b/changelog.d/fixes/release-v3850-basereds.md
new file mode 100644
index 000000000000..30444ba7064b
--- /dev/null
+++ b/changelog.d/fixes/release-v3850-basereds.md
@@ -0,0 +1,3 @@
+- fix(api): repair broken `@/lib/db/connections` import in the usage utilization route that failed the production build (#10939 follow-up)
+- chore(docs): regenerate PROVIDER_REFERENCE and refresh README diagram SVGs to the real provider count (347)
+- chore(lint): prune ESLint suppressions orphaned on the release branch
diff --git a/changelog.d/maintenance/10906-critical-db-state-assertions.md b/changelog.d/maintenance/10906-critical-db-state-assertions.md
new file mode 100644
index 000000000000..c63f5f0039a1
--- /dev/null
+++ b/changelog.d/maintenance/10906-critical-db-state-assertions.md
@@ -0,0 +1 @@
+- **test(db):** replace three empty `test.skip` placeholders in the critical DB-state suite with real assertions — `resetDbInstance` must swap the singleton while the on-disk row survives, the on-disk DB must open in WAL journal mode, and `db_meta` must hold the seeded `schema_version` — so a regression in any of those invariants can no longer pass as silently green ([#10906](https://github.com/diegosouzapw/OmniRoute/pull/10906))
diff --git a/changelog.d/maintenance/11038-filesize-baseline-fix.md b/changelog.d/maintenance/11038-filesize-baseline-fix.md
new file mode 100644
index 000000000000..aebc2b9e2349
--- /dev/null
+++ b/changelog.d/maintenance/11038-filesize-baseline-fix.md
@@ -0,0 +1 @@
+- fix(quality): rebaseline file-size for modelCapabilities.ts (1016->1072) drift from merged tip fixes (#11034 et al)
diff --git a/changelog.d/maintenance/11053-stryker-oauth-autoimport-registration.md b/changelog.d/maintenance/11053-stryker-oauth-autoimport-registration.md
new file mode 100644
index 000000000000..b2e214190099
--- /dev/null
+++ b/changelog.d/maintenance/11053-stryker-oauth-autoimport-registration.md
@@ -0,0 +1 @@
+- fix(quality): register `tests/unit/authz/oauth-autoimport-local-only.test.ts` in stryker `tap.testFiles` (residual of #11053)
diff --git a/changelog.d/maintenance/11160-drain-v3850-basereds-docs-counts-orphan-test.md b/changelog.d/maintenance/11160-drain-v3850-basereds-docs-counts-orphan-test.md
new file mode 100644
index 000000000000..e695a2b8fc0b
--- /dev/null
+++ b/changelog.d/maintenance/11160-drain-v3850-basereds-docs-counts-orphan-test.md
@@ -0,0 +1 @@
+- chore(quality): drain two `release/v3.8.50` base-reds — refresh the drifted doc counts (159 migrations, 56 free-forever providers, 40 free-tier pools, incl. the 42 `llm.txt` locale mirrors) and move `uncloseai-noauth.test.ts` to a collected path so the UncloseAI no-auth regression guard actually runs (#11160)
diff --git a/changelog.d/maintenance/vi-harimport-parity.md b/changelog.d/maintenance/vi-harimport-parity.md
new file mode 100644
index 000000000000..b08b8dc92f7d
--- /dev/null
+++ b/changelog.d/maintenance/vi-harimport-parity.md
@@ -0,0 +1 @@
+- fix(i18n): translate the 14 `providers.harImport*` keys into Vietnamese (parity gap left by #11069)
diff --git a/config/quality/dashboard-typecheck-baseline.json b/config/quality/dashboard-typecheck-baseline.json
index b97762d325e8..b596060a8ef0 100644
--- a/config/quality/dashboard-typecheck-baseline.json
+++ b/config/quality/dashboard-typecheck-baseline.json
@@ -1,9 +1,6 @@
{
- "open-sse/services/payloadRules.ts": {
- "TS2677": 1
- },
"src/app/(dashboard)/dashboard/HomePageClient.tsx": {
- "TS2339": 16
+ "TS2339": 10
},
"src/app/(dashboard)/dashboard/agent-skills/AgentSkillsPageClient.tsx": {
"TS2503": 3
@@ -120,10 +117,6 @@
"src/app/(dashboard)/dashboard/providers/[id]/components/CompatibleModelsSection.tsx": {
"TS2741": 1
},
- "src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionRow.tsx": {
- "TS2345": 3,
- "TS2322": 1
- },
"src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionsListPanel.tsx": {
"TS2322": 2
},
@@ -141,12 +134,6 @@
"src/app/(dashboard)/dashboard/providers/[id]/components/ProviderPlaygroundPanel.tsx": {
"TS2503": 1
},
- "src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx": {
- "TS2322": 1
- },
- "src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelImportHandlers.ts": {
- "TS2339": 1
- },
"src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts": {
"TS2339": 15
},
@@ -190,9 +177,6 @@
"src/lib/combos/builderDraft.ts": {
"TS2741": 1
},
- "src/lib/providers/codexFastTier.ts": {
- "TS2367": 1
- },
"src/lib/services/htmlRewriter.ts": {
"TS2322": 2,
"TS2345": 2
@@ -219,14 +203,7 @@
"src/shared/hooks/useElectron.ts": {
"TS2339": 19
},
- "src/shared/providers/webSessionCredentials.ts": {
- "TS2353": 1,
- "TS2322": 1
- },
"src/shared/schemas/cliCatalog.ts": {
"TS2554": 2
- },
- "src/shared/services/opencodeConfig.ts": {
- "TS2345": 1
}
}
diff --git a/config/quality/file-size-baseline.json b/config/quality/file-size-baseline.json
index 2e7fa58dacd9..2eb468e16c6d 100644
--- a/config/quality/file-size-baseline.json
+++ b/config/quality/file-size-baseline.json
@@ -1,5 +1,6 @@
{
"_rebaseline_2026_08_20_10531_freebuff_provider": "PR #10531 (adrianaryaputra, feat/freebuff-provider-support, closes #6793) own growth: src/shared/constants/providers/apikey/gateways.ts 1283->1298 (+15, the freebuff APIKEY_PROVIDERS_GATEWAYS catalog entry, additive data at the existing registry chokepoint, same god-file no-split rationale as prior gateways.ts rebaselines) and src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx 1062->1067 (+5, freebuff credential placeholder/hint at the existing per-provider switch chokepoint). Covered by tests/unit/freebuff-provider.test.ts (9/9 passing).",
+ "_rebaseline_2026_08_21_10987_logfare_provider": "PR #10987 (jonlwheat2-gif, feat/10644-logfare-provider, closes #10644) own growth: src/shared/constants/providers/apikey/gateways.ts 1298->1321 (+23, the logfare APIKEY_PROVIDERS_GATEWAYS catalog entry with Free badge/freeNote/apiHint documenting the request-logging policy, additive data at the existing registry chokepoint, same god-file no-split rationale as the prior gateways.ts rebaselines: #10531 freebuff, merge-storm 2026-08-11). Covered by tests/unit/logfare-registry.test.ts (1/1 passing).",
"_rebaseline_2026_08_20_10574_reasoning_transport_fallback": "PR #10574 (jackjinke, fix/responses-reasoning-transport, fixes #10550) own growth: src/sse/handlers/chatHelpers.ts 1017->1019 (+2 = the new reasoningTransportFallback option threaded through executeChatWithBreaker's options destructure and its downstream handleSingleModel call, at the existing per-attempt options-passthrough chokepoint; not extractable without splitting the option-forwarding call itself). Covered by the PR's own reasoning-policy test suite (tests/unit/chatcore-translation-paths.test.ts, tests/unit/combo-attempt-body-isolation-7847.test.ts, tests/unit/reasoning-cache.test.ts, tests/unit/strip-reasoning-blobs-agentic-context-1599.test.ts among others), 446/446 focused tests passing.",
"_rebaseline_2026_08_18_10517_zed_hosted_oauth_callback_port": "PR #10517 (phatchau036, fix/zed-hosted-oauth-callback-port) own growth: src/shared/components/OAuthModal.tsx 1131->1148 (wc -l; check-file-size.mjs counts via split(\"\\n\").length so the gate sees 1134->1149, +15/+18, crosses the frozen 1134 cap). Wires the zed-hosted native-app callback auto-complete: forceManual gating on isTrueLocalhost for zed-hosted, the loopback-redirect-URI comment block, and the exchangeToken full-URL-as-code branch, all at the existing provider-switch chokepoints this modal already carries growth for (seventh bump: 969->989->993->998->1030->1056->1100->1149; structural shrink tracked in #3501). The actual port-derivation logic lives in src/lib/oauth/providers/zed-hosted.ts (not frozen here) and was hardened during pre-merge review to use the server's own getRuntimePorts() instead of a browser-guessed scheme/port, covered by the new tests/unit/zed-hosted-loopback-port-derivation.test.ts (8/8 passing).",
"_rebaseline_2026_08_13_10243_codex_fingerprint_merge": "PR #10243 (xz-dev, Codex OAuth fingerprint convergence) merge into release/v3.8.50: src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts crossed the 1000-line new-file cap for the first time (974 on base, 997 on the PR's own branch, 1013 after merging + prettier reflow) purely from combining two independent, already-legitimate feature additions that landed on the same shared UI-helper file — this PR's own Codex fingerprint-mode select/toggle wiring (CODEX_FINGERPRINT_MODE_VALUES, getCodexFingerprintModeLabel, CodexFingerprintModeValue) plus #8949's unrelated Codex account-service-tier helpers merged concurrently on release/v3.8.50. Neither addition alone crosses the cap; git's line-level auto-merge does not detect a threshold crossing. Not modularized as part of this conflict-resolution merge commit (out of scope — this is a merge, not a feature change). Covered by the PR's own tests/unit/codex-fingerprint-convergence.test.ts, tests/unit/executor-codex.test.ts, tests/unit/provider-specific-data-schema.test.ts (all passing post-merge).",
@@ -388,6 +389,10 @@
"open-sse/services/claudeCodeCompatible.ts": 1563,
"open-sse/services/combo.ts": 4742,
"open-sse/services/compression/strategySelector.ts": 1379,
+ "open-sse/services/compression/engines/ccr/index.ts": 1024,
+ "_rebaseline_2026_08_22_11084_ccr_caller_gate": "PR #11084 (HouMinXi) own growth: open-sse/services/compression/engines/ccr/index.ts 1000->1024 (first listing — the engine was unlisted and drifted just over the 1000 cap; +24 are the callerSupportsCcrRetrieve gate that skips replacement entirely for callers without the retrieve tool, closing the stranded-prompt incident measured in production). Covered by tests/unit/compression/ccr-non-mcp-full-prompt-loss-7746.test.ts. Owner pre-authorized baseline bumps 2026-08-22.",
+ "open-sse/services/contextManager.ts": 1001,
+ "_rebaseline_2026_08_22_11113_purify_system_first": "PR #11113 (ggdayup) own growth: open-sse/services/contextManager.ts 1000->1001 (+1, purifyHistory merges the compression notice into the leading system message instead of splicing a second one mid-array — live-confirmed TokenRouter 400s; the +1 is the merge-into-leading branch, not extractable). Covered by tests/unit/context-manager-purify-system-first.test.ts. Owner pre-authorized baseline bumps 2026-08-22.",
"open-sse/services/rateLimitManager.ts": 1517,
"open-sse/translator/response/openai-responses.ts": 1652,
"open-sse/utils/cursorAgentProtobuf.ts": 1956,
@@ -443,21 +448,26 @@
"src/shared/components/ModelSelectModal.tsx": 1138,
"src/shared/constants/providers/apikey/gateways.ts": 1250
},
- "src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx": 1067,
+ "src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx": 1082,
+ "_rebaseline_2026_08_22_11156_enter_check_disabled": "PR #11156 (rqzbeh) own growth: AddApiKeyModal.tsx 1080->1082 (+2, Enter keydown handler now mirrors the isCheckDisabled condition — owner-requested post-merge polish from #11056; the rest of the diff is Prettier reflow). Covered by tests/unit/ui/add-api-key-modal-enter-key.test.tsx (jsdom render test, Enter dispatch assertions).",
"src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderConnections.ts": 1051,
"src/shared/components/ModelSelectModal.tsx": 1138,
- "src/shared/constants/providers/apikey/gateways.ts": 1298,
+ "src/shared/constants/providers/apikey/gateways.ts": 1321,
"open-sse/vendor/codex-chatgpt-web/bridge.ts": 1387,
"_rebaseline_2026_08_11_v3850_merge_storm_provider_registry": "DRIFT do merge-storm 2026-08-11 (99 PRs mergeados no release/v3.8.50). AddApiKeyModal.tsx (PR #8949 ChatGPT Web provider) e useProviderConnections.ts/ModelSelectModal.tsx (PRs #9011 combo test-all, #9499 image combos) = UI nova legitima acima do cap; gateways.ts = god-file de catalogo de providers que cresceu com PRs #9009/#9421/#9468/#9594 (qualquer split arriscaria corromper o merge de novo — o proprio PR #9421 quebrou o arquivo); bridge.ts (PR #8949) = ponte Chromium vendored; proxyFetch.ts 1207->1220 = drift herdado de merges. Owner autorizou rebaseline com anotacao (2026-08-11).",
- "src/lib/modelCapabilities.ts": 1016,
+ "src/lib/modelCapabilities.ts": 1072,
+ "_rebaseline_2026_08_21_11034_effort_variants": "DRIFT do tip (base-red #9985): modelCapabilities.ts 1016->1072 (+56) acumulado por PRs ja mergeadas no release/v3.8.50 — principalmente #11034 (resolve effort-variant capabilities a partir do modelo base), alem de #10963/#11040/#10987 growth dos catalogos. Tip puro ficou vermelho neste gate; rebaseline no tip por push direto (owner pre-autorizou crescimento legitimo). Nao tocou no arquivo da #11038.",
"src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts": 1014,
"open-sse/config/imageRegistry.ts": 1034,
"src/sse/handlers/chatHelpers.ts": 1019,
- "src/shared/middleware/chatBodyAdmission.ts": 1005,
+ "src/shared/middleware/chatBodyAdmission.ts": 1009,
+ "_rebaseline_2026_08_22_11020_sigterm_drain": "PR #11020 (RaviTharuma) own growth: chatBodyAdmission.ts 1005->1009 (+4, heavyweight admission leases now increment the SIGTERM drain counter and releaseChatAdmissionWhenDone holds it for the SSE lifetime — closes #11015; +4 are the lease/drain wiring lines at the existing admission chokepoint). Covered by tests/unit/chat-body-admission.test.ts heavyweight-lease cases. Owner pre-authorized baseline bumps 2026-08-22.",
"_rebaseline_2026_08_20_10668_tabitoken_gateway": "#10668 (yawar-aquil) own catalog growth: src/shared/constants/providers/apikey/gateways.ts 1268->1283 (+15, entirely this PR diff -- one new tabitoken gateway entry, data lines only; base moved from 1255 to 1268 via other merges since the PR forked). Not combination drift: reproducible on the PR branch alone, so the WS5.5 release-captain rule does not apply. Extraction is not available -- the file is pure data (own header: \"Pure data; merged by apikey/index.ts via spread\") and already split into 6 family files under apikey/. Same precedent as _rebaseline_2026_08_14_imagetotext_servicekinds (#10275/#10291, gateways.ts 1250->1255, data lines only) and _rebaseline_2026_08_11_v3850_merge_storm_provider_registry (owner-authorized for this same file).",
- "open-sse/executors/commandCode.ts": 1038,
+ "open-sse/executors/commandCode.ts": 1059,
"_rebaseline_2026_08_21_10859_vision_bridge_catalog": "#10859 own growth (Vision Bridge fixes #10808/#10809): src/lib/modelCapabilities.ts 1006->1016 (+10, cmd/gpt-5.3-codex* text-only capability resolution) and open-sse/executors/commandCode.ts 988->1023 (+35, Command Code wire-model normalization for bare ids + reasoning field fallback for opencode-routed gateways). Cohesive bug fixes at the existing capability-resolution / executor chokepoints; not extractable mid-fix. Covered by tests/unit/model-capabilities-command-code-codex-textonly-10703.test.ts, tests/unit/command-code-vision.test.ts, tests/unit/opencode-mimo-reasoning-details-nonstream.test.ts. Pushed directly to release (own-session miss: the original rebaseline was made in a throwaway validation worktree and never landed on the PR branch or the release before merge).",
- "_rebaseline_2026_08_21_10907_sticky_pin_clear": "#10907 own growth: open-sse/executors/commandCode.ts 1023->1038 (+15, effort-suffix sanitization threading for the sticky-pin-clear fix). Cohesive change at the existing executor chokepoint. Covered by tests/unit/command-code-executor.test.ts."
+ "_rebaseline_2026_08_21_10907_sticky_pin_clear": "#10907 own growth: open-sse/executors/commandCode.ts 1023->1038 (+15, effort-suffix sanitization threading for the sticky-pin-clear fix). Cohesive change at the existing executor chokepoint. Covered by tests/unit/command-code-executor.test.ts.",
+ "_rebaseline_2026_08_21_10986_reasoning_only_content": "#10986 own growth: open-sse/executors/commandCode.ts 1038->1059 (+21, reasoning-only content fallback — when upstream emits only reasoning-delta events and never a text-delta, surface the reasoning text as message.content in createJsonResponse and emit a synthetic content delta in createStreamResponse). Cohesive bug fix at the existing executor chokepoint (mirrors precedent style of #10907/#10859). Covered by tests/unit/command-code-executor.test.ts (2 new cases: non-stream + streaming).",
+ "_rebaseline_2026_08_21_11069_m365_har_import": "#11069 own growth: AddApiKeyModal.tsx 1073->1080 (+7 = Import .har file button for the copilot-m365-web credential modal — M365 is the only provider whose credential (access_token+chathubPath) must be extracted from a DevTools HAR WebSocket URL, added as a new modal affordance). Cohesive UI at the existing modal chokepoint; not extractable. Covered by tests/unit/m365-har-import*.test.ts."
},
"_rebaseline_base_2026_08_10_proxyfetch": "Base-red fix (green-prs sweep, issue #9985): open-sse/utils/proxyFetch.ts 1207 > cap 1000 — new proxied-TLS fetch helper introduced by the Fal reference-image work. Owner-authorized quick rebaseline to green; structural slim tracked for v3.9.0.",
"_rebaseline_2026_07_27_v3849_train2": "Merge-train 2 (7 PRs) — owner-approved 2026-07-27. Single entry: chatCore.ts 4955->5006 (#8595, Responses multi-turn image compaction before the context hard-reject). Genuine irreducible growth at the existing compaction chokepoint in handleChatCore — the PR adds a last-resort retry against the concrete budget plus the estimateFinalInputTokens helper, both wired at the pre-existing call site rather than a new branch. Covered by tests/unit/8560-responses-image-compaction.test.ts (4 tests).",
diff --git a/config/quality/open-sse-typecheck-baseline.json b/config/quality/open-sse-typecheck-baseline.json
index c6de98b41840..753e9286c432 100644
--- a/config/quality/open-sse-typecheck-baseline.json
+++ b/config/quality/open-sse-typecheck-baseline.json
@@ -1,11 +1,4 @@
{
- "open-sse/handlers/chatCore/clientUsageBuffer.ts": {
- "TS2345": 2
- },
- "open-sse/utils/stream.ts": {
- "TS2345": 2,
- "TS2322": 2
- },
"src/lib/guardrails/videoBridgeHelpers.ts": {
"TS2488": 1,
"TS2365": 2,
diff --git a/config/quality/quality-baseline.json b/config/quality/quality-baseline.json
index 95e35a5adec2..604a5a8e19da 100644
--- a/config/quality/quality-baseline.json
+++ b/config/quality/quality-baseline.json
@@ -197,10 +197,11 @@
"_rebaseline_2026_08_09_v3850_release_close": "7666 -> 8045 (+379 gzip bytes, +4.9%). Release v3.8.50 close reconciliation measured twice with the real size-limit + @size-limit/file path on tip e0ce95c592. Per-entry measurements remain below their absolute budgets: omniroute.mjs 4380/15000, mcp-server.mjs 1195/5000, nodeRuntimeSupport.mjs 887/8000, reset-password.mjs 1583/6000. The growth accumulated through legitimate CLI/runtime work in this cycle, including global-install ESM alias resolution, Termux cache preparation, and MCP stdio startup hardening; no entrypoint is near its absolute ceiling. The direction:down ratchet stays blocking from this exact measured tip."
},
"openapiBreaking": {
- "value": 0,
+ "value": 4,
"direction": "down",
"dedicatedGate": true,
- "_note": "oasdiff breaking-change gate (Fase 9 Onda 0). Blocks any breaking change vs base spec."
+ "_note": "oasdiff breaking-change gate (Fase 9 Onda 0). Blocks any breaking change vs base spec.",
+ "_rebaseline_2026_08_22_combo_create_min1": "0 -> 4, split 3 own + 1 inherited. Docs-only alignment of components.schemas.ComboCreate with the request contract already enforced by the API since 638fc5fbd (combo create refuses an empty model list) and d5034ea52: `model`/`nodes` were phantom properties the server never accepted, and `models` (array, minItems 1) is the real required field. OWN findings (3, caused by this commit): removed `model`, removed `nodes`, added required `models` on POST /api/combos — spec-vs-server drift, not client-facing breakage, no working client could have relied on the removed shapes. INHERITED finding (1, NOT caused by this PR's code changes — pre-existing drift already present at parent d5034ea52): PATCH /api/combos/{id} request-body-added-required; that route's patch operation declares its own inline requestBody (required: true, bare object schema, docs/openapi.yaml ~2107-2118) and does not reference ComboCreate, so this finding exists independently of the ComboCreate alignment (same own-growth vs inherited-drift convention as _rebaseline_2026_07_20_aliasresolver_hook_split_7808). No code change in this PR; follow-up tracking = this change's PR description."
},
"mutationScore.src/sse/services/auth.ts": {
"value": 52.57,
diff --git a/docs/architecture/RESILIENCE_GUIDE.md b/docs/architecture/RESILIENCE_GUIDE.md
index 030f65dd4141..0048761e6093 100644
--- a/docs/architecture/RESILIENCE_GUIDE.md
+++ b/docs/architecture/RESILIENCE_GUIDE.md
@@ -448,14 +448,14 @@ classification rules pick the fallback `reason` and lock `scope`
Classification rules only see full error **text** (needed to match body
markers like `额度不足`) for providers listed in the `FULL_TEXT_RULE_PROVIDERS`
allowlist in `providerErrorRules.ts` — currently only `"agentrouter"`. For
-every other provider, `checkFallbackError` hands `getProviderErrorRuleMatch`
-only the structured error (`{code, type}`), which is enough for
-header/status/code-based rules but blind to body-text markers. The helper
-`resolveRuleMatchBody()` performs this selection: full error text for
-allowlisted providers, the structured error otherwise. Adding a provider to
-`FULL_TEXT_RULE_PROVIDERS` is an explicit per-provider opt-in — it exists so
-that the default path for every provider not on the list stays
-byte-for-byte unchanged.
+every other **built-in catalog** provider, `checkFallbackError` hands
+`getProviderErrorRuleMatch` only the structured error (`{code, type}`), which
+is enough for header/status/code-based rules but blind to body-text markers.
+The helper `resolveRuleMatchBody()` performs this selection: full error text
+for allowlisted providers, the structured error otherwise. Adding a
+**built-in** provider to `FULL_TEXT_RULE_PROVIDERS` is an explicit per-provider
+opt-in — it exists so that the default path for every provider not on the
+list stays byte-for-byte unchanged.
A rule's `scope` (`model` / `provider` / `connection`) is a separate opt-in
from `FULL_TEXT_RULE_PROVIDERS`: `checkFallbackError` only surfaces it as
@@ -466,6 +466,31 @@ honorsRuleLockScope()` — today only `"agentrouter"`). See "Restated quota
errors" above for what a `scope: "connection"` match actually does once a
provider is on that allowlist.
+**#11104 — operator-declared rules bypass both allowlists.** An operator can
+declare a per-provider rule at runtime via `settings.providerErrorRules`
+(`open-sse/config/providerErrorRules.ts::setOperatorProviderErrorRules`)
+without editing this file. Gating an operator rule behind
+`FULL_TEXT_RULE_PROVIDERS`/`HONORS_RULE_LOCK_SCOPE_PROVIDERS` — allowlists
+meant to protect the **default** behavior of built-in catalog rules — would
+make the settings mechanism inert for every provider except the ones already
+listed there, since declaring the rule is already the operator's explicit
+opt-in. `resolveRuleMatchBody()` and `honorsRuleLockScope()` both check
+`hasOperatorRuleForProvider()` first: a provider with an operator rule gets
+the raw error text and has its declared `scope` honored, regardless of
+whether it also appears in either allowlist.
+
+**Known gap — `providerRuleRegistry` is never consulted for HTTP 400.**
+`checkFallbackError`'s `BAD_REQUEST` branch classifies status 400 entirely
+through its own pattern arrays (`MODEL_ACCESS_DENIED_PATTERNS`,
+`CONTEXT_OVERFLOW_PATTERNS`, etc. in `accountFallback.ts`) and returns before
+the `configuredRule`/`getProviderErrorRuleMatch` branch above it is reached.
+A built-in catalog rule (or an operator rule) with `status: 400` is
+syntactically valid but will never fire. No existing rule targets 400 today,
+so nothing in production is affected — but a future 400 rule needs this
+branch touched first, which is a larger change than adding a rule (it
+reclassifies 400 for every provider already relying on the pattern-array
+behavior) and is out of scope for a single-provider rule addition.
+
### Adding a new quota-misstating gateway
1. Register one rule array in `statusRestatementRegistry`
diff --git a/docs/changelog/fragments/10962.md b/docs/changelog/fragments/10962.md
new file mode 100644
index 000000000000..5170a415e3f1
--- /dev/null
+++ b/docs/changelog/fragments/10962.md
@@ -0,0 +1 @@
+fix(catalog): expose only provider-routable GLM reasoning-effort tiers and remove unroutable ZCode aliases
diff --git a/docs/diagrams/free-tier-budget.svg b/docs/diagrams/free-tier-budget.svg
index e4503b5534e7..393ee005941d 100644
--- a/docs/diagrams/free-tier-budget.svg
+++ b/docs/diagrams/free-tier-budget.svg
@@ -1,4 +1,4 @@
-
+
~1.51B
FREE TOKENS / MONTH · STEADY
up to ~2.13B in your first month — signup credits
- documented free tiers · 41 provider pools · 495 models · one endpoint
+ documented free tiers · 40 provider pools · 495 models · one endpoint
+
Animated promise card: six pillar tiles fade in in reading order, then a soft colored border highlight sweeps from tile to tile in a continuous cycle.
diff --git a/docs/guides/DOCKER_GUIDE.md b/docs/guides/DOCKER_GUIDE.md
index 61d414de2720..b24e7b7f6109 100644
--- a/docs/guides/DOCKER_GUIDE.md
+++ b/docs/guides/DOCKER_GUIDE.md
@@ -505,7 +505,7 @@ Stock Docker / Kubernetes OmniRoute is **one Node process + one SQLite writer**.
| Constraint | Consequence |
| --- | --- |
| Single writer | Do **not** run multiple replicas against the same SQLite file. That corrupts the DB. |
-| Recreate / restart / HEALTHCHECK kill | **Full outage** of in-flight SSE, dashboard sessions, and in-memory state. Every connected client drops. |
+| Recreate / restart / HEALTHCHECK kill | **Full outage** of in-flight SSE, dashboard sessions, and in-memory state. Every connected client drops. New requests during the empty-endpoint window get a reverse-proxy **`502 Bad Gateway: Unknown error`**, not OmniRoute JSON — clients cannot distinguish this from a provider failure (#11015). |
| Same event loop as `/healthz` | A busy catalog or compression tick can delay probes; a short timeout then restarts the **only** replica. |
**Probe matrix** (see also [Kubernetes probe recommendations](../ops/MONITORING_GUIDE.md#kubernetes-probe-recommendations)):
@@ -518,6 +518,35 @@ Stock Docker / Kubernetes OmniRoute is **one Node process + one SQLite writer**.
**Upgrades:** expect every session to drop. Drain clients if you can; there is no rolling update on default SQLite. Compose `restart: unless-stopped` plus Docker `HEALTHCHECK` will also replace the only process when the container is Unhealthy — same blast radius.
+Kubernetes snippet for a **single replica** (Recreate is required; do not raise `replicas` against one SQLite file):
+
+```yaml
+spec:
+ replicas: 1
+ strategy:
+ type: Recreate
+ template:
+ spec:
+ terminationGracePeriodSeconds: 90
+ containers:
+ - name: omniroute
+ lifecycle:
+ preStop:
+ exec:
+ command: ["/bin/sleep", "15"]
+ readinessProbe:
+ httpGet:
+ path: /healthz
+ port: 20128
+ periodSeconds: 5
+ livenessProbe:
+ tcpSocket:
+ port: 20128
+ periodSeconds: 20
+```
+
+`preStop` sleep lets kube drop Service endpoints before SIGTERM so **new** traffic stops hitting the dying process. In-flight `/v1/responses` SSE is drained up to `SHUTDOWN_TIMEOUT_MS` (default 30s) via heavyweight admission leases (#11015). New requests that still reach the process get `503` + `Retry-After: 5`. The Recreate empty-endpoint gap until the replacement is Ready remains a hard outage — that is the SQLite topology, not a probe misconfig.
+
External Postgres / multi-writer HA is **not** a documented stock path. If you need HA, keep a single replica or run a topology the project has tested and documented separately. The Postgres/MySQL work lives in [#8075](https://github.com/diegosouzapw/OmniRoute/issues/8075). Until that ships, the only supported way to multiply **large** `/v1/responses` capacity is N independent processes (next section), not `replicas > 1` on one volume.
## Scale-out: N independent processes
diff --git a/docs/i18n/ar/llm.txt b/docs/i18n/ar/llm.txt
index 4bbfed2b1a93..188e4c546fd8 100644
--- a/docs/i18n/ar/llm.txt
+++ b/docs/i18n/ar/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/az/llm.txt b/docs/i18n/az/llm.txt
index 22c327b815ff..1778044af165 100644
--- a/docs/i18n/az/llm.txt
+++ b/docs/i18n/az/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/bg/llm.txt b/docs/i18n/bg/llm.txt
index 22c327b815ff..1778044af165 100644
--- a/docs/i18n/bg/llm.txt
+++ b/docs/i18n/bg/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/bn/llm.txt b/docs/i18n/bn/llm.txt
index 5435e521e9fa..e1f037d66984 100644
--- a/docs/i18n/bn/llm.txt
+++ b/docs/i18n/bn/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/cs/llm.txt b/docs/i18n/cs/llm.txt
index db22c036bc1e..c181079187f7 100644
--- a/docs/i18n/cs/llm.txt
+++ b/docs/i18n/cs/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/da/llm.txt b/docs/i18n/da/llm.txt
index b0b593980fd6..fea53e17b2ac 100644
--- a/docs/i18n/da/llm.txt
+++ b/docs/i18n/da/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/de/llm.txt b/docs/i18n/de/llm.txt
index 118c84fed59a..494914668a98 100644
--- a/docs/i18n/de/llm.txt
+++ b/docs/i18n/de/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/es/llm.txt b/docs/i18n/es/llm.txt
index c9e3f0f3b4d6..6dfe5a95b36c 100644
--- a/docs/i18n/es/llm.txt
+++ b/docs/i18n/es/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/fa/llm.txt b/docs/i18n/fa/llm.txt
index b222f977adf5..55c6e845de37 100644
--- a/docs/i18n/fa/llm.txt
+++ b/docs/i18n/fa/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/fi/llm.txt b/docs/i18n/fi/llm.txt
index ee6328847ce9..ca8eb2a75b3b 100644
--- a/docs/i18n/fi/llm.txt
+++ b/docs/i18n/fi/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/fr/llm.txt b/docs/i18n/fr/llm.txt
index b981f381ff04..6fc229f45d5a 100644
--- a/docs/i18n/fr/llm.txt
+++ b/docs/i18n/fr/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/gu/llm.txt b/docs/i18n/gu/llm.txt
index a5ffba4c86fc..0ef4d516e711 100644
--- a/docs/i18n/gu/llm.txt
+++ b/docs/i18n/gu/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/he/llm.txt b/docs/i18n/he/llm.txt
index 97b10b910bf5..e3d3b77ab8ed 100644
--- a/docs/i18n/he/llm.txt
+++ b/docs/i18n/he/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/hi/llm.txt b/docs/i18n/hi/llm.txt
index 13cf7a5e14c5..f92757a9f3f1 100644
--- a/docs/i18n/hi/llm.txt
+++ b/docs/i18n/hi/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/hu/llm.txt b/docs/i18n/hu/llm.txt
index 12d55db0aa44..e3ba1fa0a65d 100644
--- a/docs/i18n/hu/llm.txt
+++ b/docs/i18n/hu/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/id/llm.txt b/docs/i18n/id/llm.txt
index bafb1ea87667..5a169f9e8627 100644
--- a/docs/i18n/id/llm.txt
+++ b/docs/i18n/id/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/in/llm.txt b/docs/i18n/in/llm.txt
index 416ca93e85a7..e0b18cb0baad 100644
--- a/docs/i18n/in/llm.txt
+++ b/docs/i18n/in/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/it/llm.txt b/docs/i18n/it/llm.txt
index 7c155d5b8a64..dbde86f284ba 100644
--- a/docs/i18n/it/llm.txt
+++ b/docs/i18n/it/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/ja/llm.txt b/docs/i18n/ja/llm.txt
index 8f3361f565f6..4bae4264258b 100644
--- a/docs/i18n/ja/llm.txt
+++ b/docs/i18n/ja/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/ko/llm.txt b/docs/i18n/ko/llm.txt
index 882a73a3fc11..a2310374798c 100644
--- a/docs/i18n/ko/llm.txt
+++ b/docs/i18n/ko/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/mr/llm.txt b/docs/i18n/mr/llm.txt
index 5a5a15aafe18..d40eb3779760 100644
--- a/docs/i18n/mr/llm.txt
+++ b/docs/i18n/mr/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/ms/llm.txt b/docs/i18n/ms/llm.txt
index 9dca2bead653..cdf457c441ef 100644
--- a/docs/i18n/ms/llm.txt
+++ b/docs/i18n/ms/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/nl/llm.txt b/docs/i18n/nl/llm.txt
index 7c8a64b955de..b2539aceb9ed 100644
--- a/docs/i18n/nl/llm.txt
+++ b/docs/i18n/nl/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/no/llm.txt b/docs/i18n/no/llm.txt
index 00721607ea4c..9b4dedc12741 100644
--- a/docs/i18n/no/llm.txt
+++ b/docs/i18n/no/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/phi/llm.txt b/docs/i18n/phi/llm.txt
index cbda0932809b..d9b674c08eb9 100644
--- a/docs/i18n/phi/llm.txt
+++ b/docs/i18n/phi/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/pl/llm.txt b/docs/i18n/pl/llm.txt
index 8266f33a9d2a..4c43c03d3600 100644
--- a/docs/i18n/pl/llm.txt
+++ b/docs/i18n/pl/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/pt-BR/llm.txt b/docs/i18n/pt-BR/llm.txt
index 53dbfb7774df..ecbeb9ad4c8d 100644
--- a/docs/i18n/pt-BR/llm.txt
+++ b/docs/i18n/pt-BR/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/pt/llm.txt b/docs/i18n/pt/llm.txt
index a45d3424ffbe..7cd77fdd4a61 100644
--- a/docs/i18n/pt/llm.txt
+++ b/docs/i18n/pt/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/ro/llm.txt b/docs/i18n/ro/llm.txt
index 696627ccd79b..a4f03e94e7aa 100644
--- a/docs/i18n/ro/llm.txt
+++ b/docs/i18n/ro/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/ru/llm.txt b/docs/i18n/ru/llm.txt
index ce054cd01e91..8fe9b5bdb687 100644
--- a/docs/i18n/ru/llm.txt
+++ b/docs/i18n/ru/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/sk/llm.txt b/docs/i18n/sk/llm.txt
index 099b49301263..c5a67d9242e2 100644
--- a/docs/i18n/sk/llm.txt
+++ b/docs/i18n/sk/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/sv/llm.txt b/docs/i18n/sv/llm.txt
index f59efc12e934..3b7b7b674ea8 100644
--- a/docs/i18n/sv/llm.txt
+++ b/docs/i18n/sv/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/sw/llm.txt b/docs/i18n/sw/llm.txt
index 35f14edd40f5..4c7bec4311b3 100644
--- a/docs/i18n/sw/llm.txt
+++ b/docs/i18n/sw/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/ta/llm.txt b/docs/i18n/ta/llm.txt
index 76627c0648e3..5323983d3150 100644
--- a/docs/i18n/ta/llm.txt
+++ b/docs/i18n/ta/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/te/llm.txt b/docs/i18n/te/llm.txt
index fe0c9aa843f5..ce196f99275f 100644
--- a/docs/i18n/te/llm.txt
+++ b/docs/i18n/te/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/th/llm.txt b/docs/i18n/th/llm.txt
index 5686499ba266..39eb9c04ff88 100644
--- a/docs/i18n/th/llm.txt
+++ b/docs/i18n/th/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/tr/llm.txt b/docs/i18n/tr/llm.txt
index 2add1f0955b2..7f848b6cdd65 100644
--- a/docs/i18n/tr/llm.txt
+++ b/docs/i18n/tr/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/uk-UA/llm.txt b/docs/i18n/uk-UA/llm.txt
index 29eda2adb0d2..bca18382ad25 100644
--- a/docs/i18n/uk-UA/llm.txt
+++ b/docs/i18n/uk-UA/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/ur/llm.txt b/docs/i18n/ur/llm.txt
index 76473b3d266f..85369bee2e9a 100644
--- a/docs/i18n/ur/llm.txt
+++ b/docs/i18n/ur/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/vi/llm.txt b/docs/i18n/vi/llm.txt
index 9d491c439d38..da6b9b7179a1 100644
--- a/docs/i18n/vi/llm.txt
+++ b/docs/i18n/vi/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/zh-CN/llm.txt b/docs/i18n/zh-CN/llm.txt
index 49e8eb4d4821..0c737e5dc432 100644
--- a/docs/i18n/zh-CN/llm.txt
+++ b/docs/i18n/zh-CN/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/i18n/zh-TW/llm.txt b/docs/i18n/zh-TW/llm.txt
index 861c1e655159..643943547df8 100644
--- a/docs/i18n/zh-TW/llm.txt
+++ b/docs/i18n/zh-TW/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -438,7 +438,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index e51b6091aeac..73941f37ead8 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -8893,12 +8893,20 @@ components:
ComboCreate:
type: object
- required: [name, model]
+ required: [name, models]
properties:
name:
type: string
- model:
- type: string
+ models:
+ type: array
+ minItems: 1
+ items:
+ oneOf:
+ - type: string
+ description: "provider/model reference"
+ - type: object
+ description: "structured combo step (provider, model, weight, ...)"
+ additionalProperties: true
strategy:
type: string
enum:
@@ -8920,14 +8928,3 @@ components:
- context-optimized
- fusion
default: priority
- nodes:
- type: array
- items:
- type: object
- properties:
- connectionId:
- type: string
- weight:
- type: integer
- priority:
- type: integer
diff --git a/docs/ops/REDIS_PRODUCTION_CONFIG.md b/docs/ops/REDIS_PRODUCTION_CONFIG.md
index e8749c7bbcdb..ada9ad445672 100644
--- a/docs/ops/REDIS_PRODUCTION_CONFIG.md
+++ b/docs/ops/REDIS_PRODUCTION_CONFIG.md
@@ -14,9 +14,12 @@ workloads:
| Workload | Driver | Client Factory | Key Pattern |
|---|---|---|---|
-| Rate limiting | `rateLimiter.ts` | `getRedisClient()` — lazy `ioredis` singleton | Lua‑atomic rate limit windows |
-| Auth cache | `apiKeys.ts` | Reuses `rateLimiter`'s client | `auth:api_key:` with TTL |
-| Quota store | `redisQuotaStore.ts` | Separate `getRedisClient(url)` singleton | Configurable per-instance |
+| Rate limiting | `rateLimiter.ts` | `getRedisClient()` — lazy `ioredis` singleton | `rl:*` Lua‑atomic rate limit windows |
+| Auth cache | `apiKeys.ts` | Reuses `rateLimiter`'s client | `auth:api_key:` with TTL |
+| Quota store | `redisQuotaStore.ts` | Separate `getRedisClient(url)` singleton | `quota:*` configurable per-instance |
+
+All three workloads share one namespace prefix so OmniRoute can co-exist with other apps on a
+single Redis instance (e.g. `127.0.0.1:6379`). See [Key Namespacing](#key-namespacing).
---
@@ -25,6 +28,7 @@ workloads:
| Setting | Value | Where |
|---|---|---|
| `REDIS_URL` env var | `redis://redis:6379` (compose), optional | `rateLimiter.ts:5`, `.env.example` |
+| `REDIS_KEY_PREFIX` env var | `omniroute:` (default) | `rateLimiter.ts`, `redisQuotaStore.ts`, `.env.example` |
| `QUOTA_STORE_REDIS_URL` env var | separate, can differ from `REDIS_URL` | `quota/storeFactory.ts` |
| `QUOTA_STORE_DRIVER` | `"sqlite"` (default), `"redis"` optional | `quota/storeFactory.ts` |
| ioredis `maxRetriesPerRequest` | `3` | `rateLimiter.ts` client creation |
@@ -36,6 +40,29 @@ workloads:
---
+## Key Namespacing
+
+OmniRoute shares a Redis instance with whatever else runs on the host. Without a namespace,
+keys like `auth:api_key:` or `rl:*` could collide with keys from other applications
+using the same Redis (this instance runs Redis on `127.0.0.1:6379` alongside other services).
+
+Set `REDIS_KEY_PREFIX` to a non-empty string to prefix **every** OmniRoute key:
+
+```bash
+# .env — all OmniRoute keys become omniroute:rl:*, omniroute:auth:*, omniroute:quota:*
+REDIS_KEY_PREFIX=omniroute:
+```
+
+- **Default:** `omniroute:` (applied when `REDIS_KEY_PREFIX` is unset or blank).
+- **Applied to:** rate limiter + auth cache (shared `ioredis` client via `keyPrefix`) and the
+ quota store (`KEY_PREFIX = "${REDIS_KEY_PREFIX}quota"`).
+- **Changing the prefix** when keys already exist in Redis orphans the old keys (they expire
+ via TTL / LRU). Safe to change; no migration needed.
+- **ioredis `keyPrefix`** automatically prepends the prefix on writes **and** strips it on reads,
+ so application code never sees the prefix.
+
+---
+
## Recommended Production Tuning
### 1. Connection Pool / Client Options (ioredis `Redis` constructor)
diff --git a/docs/reference/API_REFERENCE.md b/docs/reference/API_REFERENCE.md
index 359ae4750eca..1b71551e373f 100644
--- a/docs/reference/API_REFERENCE.md
+++ b/docs/reference/API_REFERENCE.md
@@ -636,6 +636,49 @@ completion.
---
+## Self-service usage (`/api/usage/om-usage`)
+
+Any API key can read **its own** usage and quotas — no management auth. This is the endpoint a
+client (CLI, the OmniCopilot panel) uses to show a key holder their spend.
+
+```bash
+# Text form (the historical contract — plain text for a terminal)
+curl -H "Authorization: Bearer " \
+ http://localhost:20128/api/usage/om-usage
+
+# Structured form — what a UI consumes
+curl -H "Authorization: Bearer " \
+ "http://localhost:20128/api/usage/om-usage?format=json"
+```
+
+The key must have **`allowUsageCommand`** enabled (off by default — the dashboard's API-key
+manager toggles it per key). Without it the endpoint answers `403`.
+
+`?format=json` returns a discriminated shape so a caller never reads a data field off a
+refusal. On success:
+
+```jsonc
+{
+ "allowed": true,
+ // present only when the key opted into per-key usage limits (daily/weekly USD):
+ "personal": { "dailySpentUsd": 1.25, "dailyLimitUsd": 5, "dailyResetAtIso": "…", "weeklySpentUsd": 8, "weeklyLimitUsd": 20, "weeklyResetAtIso": "…" /* … */ },
+ // the selected provider quota snapshot, or null when nothing is cached yet:
+ "provider": { "connectionId": "…", "provider": "claude", "plan": "…", "quotas": { /* … */ } },
+ // every connection's snapshot, so a UI can render several providers side by side:
+ "providers": [ { "connectionId": "…", "provider": "claude", /* … */ }, { "provider": "codex", /* … */ } ]
+}
+```
+
+On refusal (`401` bad key / `403` not allowed) the same route returns
+`{ "allowed": false, "error": { "message": "…" } }` — a present-but-empty `personal`/`provider`
+(key allowed, nothing learned yet) is a different state from a refusal, and only the JSON form
+distinguishes them.
+
+**Auth:** the caller's own Bearer API key, validated with `isValidApiKey` — this is *not* the
+management surface (`/api/keys/…`), which stays behind `requireManagementAuth`.
+
+---
+
## Semantic Cache
```bash
diff --git a/docs/reference/ENVIRONMENT.md b/docs/reference/ENVIRONMENT.md
index b3c12467f8cf..ae06e6209059 100644
--- a/docs/reference/ENVIRONMENT.md
+++ b/docs/reference/ENVIRONMENT.md
@@ -1343,6 +1343,7 @@ Provider quota endpoints, network tunnels (Tailscale, Ngrok, MITM debug proxy),
| `OMNIROUTE_REDIS_BIND_HOST` | `127.0.0.1` | `bin/cli/commands/redis.mjs` | Host interface the 1-click Redis launcher publishes on. The launcher starts Redis WITHOUT a password, so binding `0.0.0.0` hands every host on your LAN an unauthenticated Redis — only widen this if you also set a password on the instance yourself. |
| `REDIS_BIND_HOST` | `127.0.0.1` | `docker-compose.yml` | Host interface docker-compose publishes the Redis sidecar on (#9286). The compose Redis runs without `requirepass`; app containers reach it over the compose network (`redis:6379`) — the published port exists only for host-side tooling. `0.0.0.0` exposes an unauthenticated Redis to the whole LAN. |
| `REDIS_PORT` | `6379` | `docker-compose.yml` | Host port for the compose Redis sidecar. |
+| `REDIS_KEY_PREFIX` | `omniroute:` | `src/shared/utils/rateLimiter.ts` | Namespace prefix applied to every OmniRoute Redis key (rate limiter, auth cache, quota store). Prevents key collisions when the Redis instance is shared with other apps (#11042). |
| `OMNIROUTE_INTERNAL_SERVICE_TOKEN` | _(unset — mechanism disabled)_ | `src/lib/api/internalServiceAuth.ts` | Shared secret for identity-preserving internal REST hops (#9260): OmniRoute components calling other local OmniRoute routes send it as `x-omniroute-internal-service-token` so the original caller identity is preserved. Compared with `timingSafeEqual`. |
| `OMNIROUTE_INTERNAL_SERVICE_TOKEN_FILE` | _(unset)_ | `src/lib/api/internalServiceAuth.ts` | Secret-file variant of the internal service token: path to a file whose trimmed content is the token. Only consulted when the inline var is unset. |
| `OPENROUTER_PROVIDER_STATS_ENABLED` | `true` | `src/lib/catalog/openrouterProviderStats.ts` | Enrich the dashboard providers list with OpenRouter weekly ranking stats (#9324). On by default; set `false` to skip the background fetch entirely (non-blocking, never fatal). |
diff --git a/docs/reference/FREE_TIERS.md b/docs/reference/FREE_TIERS.md
index a0ff47191595..927dccf72013 100644
--- a/docs/reference/FREE_TIERS.md
+++ b/docs/reference/FREE_TIERS.md
@@ -120,7 +120,6 @@ A 50-agent web-research pass (official docs + last-7-days news, adversarially ve
| `firecrawl` | caution | Cloud API ToS has no explicit personal-proxy prohibition found, but the open-source self-hosted version is AGPL-3.0 (re… |
| `gemini` | caution | ToS explicitly states the free tier is for "developers building with Google AI models for professional or business purp… |
| `groq` | caution | Services Agreement §6.3 prohibits reselling, sublicensing, or distributing API access; §3.2 bars reselling/leasing acco… |
-| `hackclub` | caution | Service is explicitly scoped to Hack Club teen members building projects/learning; no public ToS found explicitly permi… |
| `huggingchat` | caution | Hugging Face ToS does not explicitly ban personal self-hosted proxies, but supplemental terms (referenced but not fully… |
| `huggingface` | caution | ToS grants a limited license to access/use the service; the document does not explicitly permit or forbid a single-user… |
| `hyperbolic` | caution | ToS grants API access "solely for your own personal or internal business purposes" and explicitly prohibits licensing, … |
@@ -222,7 +221,6 @@ A 50-agent web-research pass (official docs + last-7-days news, adversarially ve
| `duckduckgo-web` | keyless | — | — | avoid | 6 |
| `freemodel-dev` | keyless | — | — | unknown | 4 |
| `friendliai` | keyless | — | — | avoid | 2 |
-| `hackclub` | keyless | — | — | caution | 3 |
| `iflytek` | keyless | — | — | avoid | 1 |
| `inference-net` | keyless | — | — | caution | 3 |
| `liquid` | keyless | — | — | unknown | 1 |
@@ -280,7 +278,6 @@ A 50-agent web-research pass (official docs + last-7-days news, adversarially ve
- **`gitlawb`** — The shipped freeNote "Free tier available" is effectively stale. The original free MiMo access was removed in May 2026; the only remaining "free" option is a temporary promotional model (Nemotron 3 U…
- **`gitlawb-gmi`** — Partially still accurate — free tier exists but is now narrowed to a single model (Nemotron 3 Ultra) after MiMo free access was revoked in late May 2026. The shipped note "Free tier available" unders…
- **`groq`** — The shipped freeNote "30 RPM / 14.4K RPD" is accurate only for llama-3.1-8b-instant. Most other models (including llama-3.3-70b-versatile) have a much lower 1K RPD cap. The note omits model-specific …
-- **`hackclub`** — The "30+ models" count appears accurate and still matches. The core offering remains free for Hack Club members. No evidence of tightening — still "$0 ALWAYS FREE" per the homepage. The freeNote omit…
- **`huggingchat`** — The shipped freeNote ("Free LLM chat — no subscription required. Rate limits apply.") is partially accurate but significantly understates the restrictions. The free tier now operates on a hard $0.10/…
- **`huggingface`** — Significantly tightened. The shipped freeNote ("Free Inference API for thousands of models") implied unlimited/generous free access, but as of mid-2025 the free tier is capped at $0.10/month in recur…
- **`hyperbolic`** — Our shipped freeNote says "$1-5 trial credits on signup" — the $1 trial credit portion is accurate, but the "$5" figure refers to the minimum deposit required to unlock GPU rental (not free credits g…
diff --git a/docs/reference/PROVIDER_REFERENCE.md b/docs/reference/PROVIDER_REFERENCE.md
index d8e32e8da43d..8a0a3b5d99a8 100644
--- a/docs/reference/PROVIDER_REFERENCE.md
+++ b/docs/reference/PROVIDER_REFERENCE.md
@@ -1,14 +1,14 @@
---
title: "Provider Reference"
version: 3.8.50
-lastUpdated: 2026-08-21
+lastUpdated: 2026-08-22
---
# Provider Reference
> **Auto-generated** from `src/shared/constants/providers.ts` — do not edit by hand.
> Regenerate with: `npm run gen:provider-reference`
-> **Last generated:** 2026-08-21
+> **Last generated:** 2026-08-22
Total providers: **348**. See category breakdown below.
@@ -34,7 +34,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
---
-## No-auth Providers (no key required) (11)
+## No-auth Providers (no key required) (12)
| ID | Alias | Name | Tags | Website | Notes | Tool calling |
|----|-------|------|------|---------|-------|--------------|
@@ -47,6 +47,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
| `felo-web` | `felo` | Felo | No-auth | [link](https://felo.ai) | No credentials required — Felo is a free, no-signup chat/search aggregator. | — |
| `opencode` | `oc` | OpenCode Free | No-auth | [link](https://opencode.ai) | No API key required — uses OpenCode's public free endpoint. | — |
| `theoldllm` | `tllm` | The Old LLM (Free) | No-auth | [link](https://theoldllm.vercel.app) | No credentials required. The executor auto-generates access tokens via an embedded Playwright browser instance. | — |
+| `uncloseai` | `unc` | UncloseAI | No-auth | [link](https://uncloseai.com) | No auth required. API accepts any non-empty string as key for identification. If older built-in models return 404, use Available Models → Import from /models or Auto-Sync; verified live model: solidrust/Hermes-3-Llama-3.1-8B-AWQ. | — |
| `veoaifree-web` | `veo-free` | Veo AI Free | No-auth, video | [link](https://veoaifree.com) | No auth required. Rate limited to 6 requests/hour per IP. | — |
| `zcode` | `zc` | ZCode (GLM Coding Plan) | No-auth | [link](https://zcode.z.ai) | No API key stored by OmniRoute. The local ZCode app-server uses the existing builtin:zai-coding-plan login. | — |
@@ -98,7 +99,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
| `gemini-business` | `gembiz` | Gemini Business (Enterprise) | Web cookie | [link](https://business.gemini.google) | From your enterprise account: open business.gemini.google/home/cid/{your-cid}, then copy __Secure-1PSID and __Secure-1PSIDTS cookies from DevTools → Application → Cookies. Paste as a cookie header below. | — |
| `gemini-web` | `gweb` | Gemini Web (Free) | Web cookie | [link](https://gemini.google.com) | Paste your __Secure-1PSID cookie value from gemini.google.com. Optionally add __Secure-1PSIDTS separated by semicolon. | emulated |
| `grok-web` | `gw` | Grok Web (Subscription) | Web cookie | [link](https://grok.com) | Paste the full grok.com cookie line from DevTools → Application → Cookies. Include both `sso` and `sso-rw` (e.g. `sso=...; sso-rw=...`) — Grok's anti-bot rejects `sso` on its own. | — |
-| `hailuo-web` | `hailuo-web` | Hailuo Web (MiniMax) | Web cookie | [link](https://hailuo.ai) | Open hailuo.ai, log in, then open DevTools → Application → Local Storage → copy the "_token" value. device_id/uuid fingerprint fields are derived automatically; if requests fail, re-capture _token (sessions can expire). | — |
+| `hailuo-web` | `hailuo-web` | Hailuo Web (MiniMax) | Web cookie | [link](https://chat.minimax.io) | Open hailuo.ai, log in, then open DevTools → Application → Local Storage → copy the "_token" value. device_id/uuid fingerprint fields are derived automatically; if requests fail, re-capture _token (sessions can expire). | — |
| `huggingchat` | `huggingchat` | HuggingChat (Free) | Web cookie | [link](https://huggingface.co/chat) | Paste the full Cookie header from huggingface.co/chat (DevTools → Network → /chat/conversation → Request Headers → Cookie). It should include hf-chat and may also include token / aws-waf-token. | — |
| `hyperagent` | `ha` | HyperAgent (Unofficial/Experimental) | Web cookie | [link](https://hyperagent.com) | Paste the full Cookie header from hyperagent.com (DevTools → Network → any request → Request Headers → Cookie). Session cookies power chat + billing usage. | — |
| `inner-ai` | `in-ai` | Inner.ai (Subscription) | Web cookie | [link](https://app.innerai.com) | Paste your token cookie and email separated by a space: open DevTools → Application → Cookies → .innerai.com, copy the token value, then append a space and your Inner.ai login email. Example: eyJhbG... user@example.com | emulated |
@@ -120,7 +121,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
| `zai-web` | `zw` | Z.ai Web | Web cookie | [link](https://chat.z.ai) | Copy the "token" value from chat.z.ai → DevTools → Application → Local Storage. Do not copy cookies; OmniRoute handles the per-request CAPTCHA through its browser transport. | — |
| `zenmux-free` | `zmf` | ZenMux Free (Web) | Web cookie | [link](https://zenmux.ai) | Login at zenmux.ai, then export all cookies using EditThisCookie or Cookie-Editor and paste the full Cookie header string here. Refresh every ~30 days. | — |
-## API Key Providers (paid / paid-with-free-credits) (232)
+## API Key Providers (paid / paid-with-free-credits) (231)
| ID | Alias | Name | Tags | Website | Notes |
|----|-------|------|------|---------|-------|
@@ -149,7 +150,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
| `bazaarlink` | `bzl` | BazaarLink | API key | [link](https://bazaarlink.ai) | Use your BazaarLink API key (starts with sk-bl-) in Authorization: Bearer . OpenAI SDK works with base URL https://bazaarlink.ai/api/v1. Models use provider/model-name format. |
| `bedrock` | `bedrock` | Amazon Bedrock | API key, enterprise | [link](https://aws.amazon.com/bedrock) | Use your Amazon Bedrock API key and configure the AWS region where your models are enabled (for example eu-west-2). OmniRoute calls Bedrock's native Converse API directly. |
| `black-forest-labs` | `bfl` | Black Forest Labs | API key, image | [link](https://blackforestlabs.ai) | — |
-| `blackbox` | `bb` | Blackbox AI | API key | [link](https://blackbox.ai) | Limited free access is available through Blackbox; model availability and account limits apply |
+| `blackbox` | `bb` | Blackbox AI | API key | [link](https://blackbox.ai) | ⚠️ **DEPRECATED.** api.blackbox.ai returns HTTP 404 on every path variant (sweep 2026-08-21); the public inference surface has moved to the gated enterprise.blackbox.ai/v1 endpoint. |
| `bluesminds` | `bm` | BluesMinds | API key | [link](https://www.bluesminds.com) | Free daily pi credits — supports 200+ models including GPT-4o, GPT-4.1, Claude Sonnet 4.5, Gemini 2.0 Flash, DeepSeek V4, Qwen, Kimi K2 |
| `byteplus` | `bpm` | BytePlus ModelArk | API key | [link](https://console.byteplus.com/ark) | — |
| `bytez` | `bytez` | Bytez | API key | [link](https://bytez.com) | $1 free credits, refreshes every 4 weeks |
@@ -166,7 +167,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
| `clova-studio` | `clova` | Naver CLOVA Studio | API key | [link](https://api.ncloud-docs.com/docs/en/ai-naver-clovastudio-summary) | — |
| `codestral` | `codestral` | Codestral | API key | [link](https://mistral.ai) | — |
| `cohere` | `cohere` | Cohere | API key | [link](https://cohere.com) | Free Trial: 1,000 API calls/month for testing, no credit card required |
-| `command-code` | `cmd` | Command Code | API key | [link](https://commandcode.ai/) | Use a Command Code API key. Requests are sent to Command Code's /alpha/generate endpoint. |
+| `command-code` | `cmd` | Command Code | API key | [link](https://commandcode.ai/) | Use a Command Code API key. Requests are sent to Command Code's /provider/v1/chat/completions endpoint. |
| `coze` | `coze` | Coze | API key | [link](https://coze.com) | Get API key at coze.com/open/api |
| `crof` | `crof` | CrofAI | API key | [link](https://crof.ai) | — |
| `cursor-api` | `cua` | Cursor API | API key | [link](https://cursor.com/dashboard/api) | Paste a Cursor user API key (crsr_...) from cursor.com/dashboard/api. OmniRoute exchanges it for a session token on demand; no IDE or cursor-agent install is needed. Usage bills to the Cursor plan that owns the key. |
@@ -213,7 +214,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
| `glm-cn` | `glmcn` | GLM Coding (China) | API key | [link](https://open.bigmodel.cn) | — |
| `glmt` | `glmt` | GLM Thinking | API key | [link](https://open.bigmodel.cn) | — |
| `groq` | `groq` | Groq | API key | [link](https://groq.com) | Free tier: 30 RPM / 14.4K RPD — no credit card |
-| `hackclub` | `hc` | Hackclub AI | API key, aggregator | [link](https://ai.hackclub.com) | Sign in with your Hack Club account at ai.hackclub.com. |
+| `hackclub` | `hc` | Hackclub AI | API key | [link](https://ai.hackclub.com) | Sign in with your Hack Club account at ai.hackclub.com. |
| `haiper` | `hp` | Haiper | API key, video | [link](https://haiper.ai) | Get API key at haiper.ai/haiper-api |
| `hcnsec` | `hcnsec` | Huancheng Public API | API key | [link](https://api.hcnsec.cn) | Get API key at api.hcnsec.cn |
| `helixmind` | `helixmind` | HelixMind | API key, aggregator | [link](https://helixmind.online) | Previously circulated 3 RPM/50 RPD and no-card claims were not confirmed during the 2026-08-02 audit; current quota and billing require account verification. |
@@ -331,7 +332,6 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
| `topaz` | `topaz` | Topaz | API key, image | [link](https://topazlabs.com) | — |
| `typhoon` | `typhoon` | Typhoon | API key | [link](https://docs.opentyphoon.ai) | Free API key with a 5 req/s and 200 req/m rate limit. |
| `udio` | `udio` | Udio | API key | [link](https://udio.com) | Paste session cookie from udio.com (Supabase auth) |
-| `uncloseai` | `unc` | UncloseAI | API key | [link](https://uncloseai.com) | No auth required. API accepts any non-empty string as key for identification. If older built-in models return 404, use Available Models → Import from /models or Auto-Sync; verified live model: solidrust/Hermes-3-Llama-3.1-8B-AWQ. |
| `unorouter` | `unorouter` | UnoRouter | API key, aggregator | [link](https://unorouter.ai) | Models with the :free suffix do not debit balance; limit is 1 request/minute per free model per user. |
| `upstage` | `upstage` | Upstage | API key | [link](https://www.upstage.ai) | — |
| `v0-vercel` | `v0` | v0 (Vercel) | API key | [link](https://v0.dev) | — |
diff --git a/llm.txt b/llm.txt
index 3deca0171a2d..51feb87bc326 100644
--- a/llm.txt
+++ b/llm.txt
@@ -14,7 +14,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
- **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 157 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 159 migrations)
- **State management:** Zustand (client), SQLite (server persistence)
- **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -434,7 +434,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
-5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 157 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (120 domain-specific files, 159 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
diff --git a/open-sse/config/constants.ts b/open-sse/config/constants.ts
index c45cf542a661..d99da4725b05 100644
--- a/open-sse/config/constants.ts
+++ b/open-sse/config/constants.ts
@@ -171,6 +171,7 @@ export const HTTP_STATUS = {
FORBIDDEN: 403,
NOT_FOUND: 404,
NOT_ACCEPTABLE: 406,
+ UNPROCESSABLE_ENTITY: 422,
REQUEST_TIMEOUT: 408,
GONE: 410,
RATE_LIMITED: 429,
@@ -263,11 +264,17 @@ export const PROVIDER_PROFILES = {
circuitBreakerReset: envInt("OMNIROUTE_CIRCUIT_BREAKER_API_KEY_RESET_MS", 30000),
// Provider-level circuit breaker (entire provider cooldown after repeated failures)
providerFailureThreshold: envInt("OMNIROUTE_PROVIDER_BREAKER_API_KEY_FAILURE_THRESHOLD", 15), // Scaled for 500+ connections (was 5)
- providerFailureWindowMs: envInt("OMNIROUTE_PROVIDER_BREAKER_API_KEY_FAILURE_WINDOW_MS", 1800000), // 30min window (was 20min)
+ providerFailureWindowMs: envInt(
+ "OMNIROUTE_PROVIDER_BREAKER_API_KEY_FAILURE_WINDOW_MS",
+ 1800000
+ ), // 30min window (was 20min)
providerCooldownMs: envInt("OMNIROUTE_PROVIDER_BREAKER_API_KEY_COOLDOWN_MS", 600000), // 10min cooldown when threshold reached
degradationThreshold: envInt("OMNIROUTE_PROVIDER_BREAKER_API_KEY_DEGRADATION_THRESHOLD", 7),
maxBackoffMultiplier: envInt("OMNIROUTE_PROVIDER_BREAKER_API_KEY_MAX_BACKOFF_MULTIPLIER", 4),
- backoffEscalationCount: envInt("OMNIROUTE_PROVIDER_BREAKER_API_KEY_BACKOFF_ESCALATION_COUNT", 3),
+ backoffEscalationCount: envInt(
+ "OMNIROUTE_PROVIDER_BREAKER_API_KEY_BACKOFF_ESCALATION_COUNT",
+ 3
+ ),
},
// Local providers (localhost inference backends like Ollama, LM Studio, oMLX).
// Not yet wired into getProviderProfile() — will be used when local provider_nodes
@@ -348,6 +355,23 @@ export const STREAM_RECOVERY = {
HOLDBACK_MS: 750,
BUFFER_MAX_BYTES: 65536,
EARLY_RETRY_MAX: 4,
+ /**
+ * Minimum character overlap `trimContinuationOverlap` must find between the
+ * already-emitted text and a mid-stream continuation for the continuation to be
+ * accepted as a real resume, rather than an unrelated restart the model produced after
+ * ignoring the assistant-prefill.
+ *
+ * This is a DOCUMENTED TRADE-OFF, not a solved distinction: a model that continues
+ * cleanly with fewer than this many echoed characters (a legitimate, even preferred,
+ * outcome — there was nothing to de-duplicate) is indistinguishable, from string data
+ * alone, from a model that silently restarted on an unrelated sentence. Both produce a
+ * low/zero overlap. Rejecting below this threshold trades some false-positive rejections
+ * of legitimate low-overlap continuations (bounded retry, then a clean close — no data
+ * loss beyond that retry) against not silently gluing two unrelated fragments into one
+ * corrupted, unrecoverable answer. It does not eliminate the residual false negative
+ * either (an accidental coincidence at or above this many characters is still accepted).
+ */
+ MIN_CONTINUATION_OVERLAP_CHARS: 8,
} as const;
/**
diff --git a/open-sse/config/freeModelCatalog.data.ts b/open-sse/config/freeModelCatalog.data.ts
index e6ef081aa7e7..38c17abf2d9a 100644
--- a/open-sse/config/freeModelCatalog.data.ts
+++ b/open-sse/config/freeModelCatalog.data.ts
@@ -194,9 +194,6 @@ export const FREE_MODEL_BUDGETS: FreeModelBudget[] = [
{ provider: "groq", modelId: "openai/gpt-oss-120b", displayName: "GPT-OSS 120B", monthlyTokens: 15000000, creditTokens: 0, freeType: "recurring-daily", poolKey: "groq", tos: "caution", hardStopGuaranteed: true },
{ provider: "groq", modelId: "openai/gpt-oss-20b", displayName: "GPT-OSS 20B", monthlyTokens: 15000000, creditTokens: 0, freeType: "recurring-daily", poolKey: "groq", tos: "caution", hardStopGuaranteed: true },
{ provider: "groq", modelId: "qwen/qwen3-32b", displayName: "Qwen3 32B", monthlyTokens: 15000000, creditTokens: 0, freeType: "recurring-daily", poolKey: "groq", tos: "caution", hardStopGuaranteed: true },
- { provider: "hackclub", modelId: "meta-llama/llama-3.3-70b-instruct", displayName: "Llama 3.3 70B", monthlyTokens: 0, creditTokens: 0, freeType: "keyless", poolKey: "hackclub", tos: "caution" },
- { provider: "hackclub", modelId: "mistralai/mistral-7b-instruct", displayName: "Mistral 7B", monthlyTokens: 0, creditTokens: 0, freeType: "keyless", poolKey: "hackclub", tos: "caution" },
- { provider: "hackclub", modelId: "deepseek-ai/deepseek-coder-33b", displayName: "DeepSeek Coder 33B", monthlyTokens: 0, creditTokens: 0, freeType: "keyless", poolKey: "hackclub", tos: "caution" },
{ provider: "huggingchat", modelId: "baidu/ERNIE-4.5-VL-424B-A47B-Base-PT", displayName: "ERNIE 4.5 VL 424B A47B Base PT", monthlyTokens: 500000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "huggingchat", tos: "caution" },
{ provider: "huggingchat", modelId: "CohereLabs/c4ai-command-r7b-12-2024", displayName: "Command R7B 12-2024", monthlyTokens: 500000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "huggingchat", tos: "caution" },
{ provider: "huggingchat", modelId: "CohereLabs/command-a-reasoning-08-2025", displayName: "Command A Reasoning 08-2025", monthlyTokens: 500000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "huggingchat", tos: "caution" },
diff --git a/open-sse/config/glmProvider.ts b/open-sse/config/glmProvider.ts
index 9c1580e7aedd..8668de2c6368 100644
--- a/open-sse/config/glmProvider.ts
+++ b/open-sse/config/glmProvider.ts
@@ -19,17 +19,16 @@ export const GLM_ANTHROPIC_DEFAULT_BASE_URLS = Object.freeze({
export const GLM_SHARED_MODELS = Object.freeze([
{
- // GLM-5.3 (2026-08-14): one upstream id; effort is the reasoning_effort
- // param (low|high|max, default max) — the -high/-low entries below are
- // OmniRoute aliases resolved by GlmExecutor::parseGlmEffortTier.
- // Default context window not yet published by Z.ai; 1M mirrored from
- // GLM-5.2 (same base model). https://z.ai/blog/glm-5.3
+ // GLM-5.3 exposes low|high|max reasoning_effort (default max); -high/-low
+ // are OmniRoute aliases resolved by GlmExecutor::parseGlmEffortTier.
+ // https://docs.z.ai/guides/llm/glm-5.3
id: "glm-5.3",
name: "GLM 5.3",
contextLength: 1000000,
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: ["low", "high", "max"],
},
{
id: "glm-5.3-high",
@@ -38,6 +37,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: ["high"],
},
{
id: "glm-5.3-low",
@@ -46,14 +46,19 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: ["low"],
},
{
+ // GLM-5.2 has two positive effective tiers: low/medium map to high and xhigh
+ // maps to max; disabling thinking remains the separate thinking toggle.
+ // https://docs.z.ai/guides/capabilities/thinking
id: "glm-5.2",
name: "GLM 5.2",
contextLength: 1000000,
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: ["high", "max"],
},
{
id: "glm-5.2-high",
@@ -62,6 +67,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: ["high"],
},
{
id: "glm-5.2-max",
@@ -70,14 +76,18 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: ["max"],
},
{
+ // Earlier GLM families support the thinking toggle, not reasoning_effort.
+ // An explicit empty list prevents generic catalog tiers from being inferred.
id: "glm-5.1",
name: "GLM 5.1",
contextLength: 204800,
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
},
{
id: "glm-5",
@@ -86,6 +96,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
},
{
id: "glm-5-turbo",
@@ -94,6 +105,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
},
{
id: "glm-4.7-flash",
@@ -102,6 +114,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
},
{
id: "glm-4.7",
@@ -110,6 +123,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 131072,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
},
{
id: "glm-4.6v",
@@ -118,6 +132,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 32768,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
supportsVision: true,
},
{
@@ -127,6 +142,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 32768,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
},
{
id: "glm-4.5v",
@@ -135,6 +151,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 32768,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
supportsVision: true,
},
{
@@ -144,6 +161,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 32768,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
},
{
id: "glm-4.5-air",
@@ -152,6 +170,7 @@ export const GLM_SHARED_MODELS = Object.freeze([
maxOutputTokens: 32768,
toolCalling: true,
supportsReasoning: true,
+ supportedThinkingEfforts: [],
},
]);
diff --git a/open-sse/config/opencodeZenGoSharedModels.ts b/open-sse/config/opencodeZenGoSharedModels.ts
new file mode 100644
index 000000000000..9f9d6628e915
--- /dev/null
+++ b/open-sse/config/opencodeZenGoSharedModels.ts
@@ -0,0 +1,16 @@
+/**
+ * Models declared identically in both the `opencode-zen` and `opencode-go` provider
+ * registries (same upstream family, opencode.ai/zen/*). Mirrors the GLM_SHARED_MODELS
+ * pattern in glmProvider.ts: one array, spread into each sibling RegistryEntry, so a
+ * metadata fix (targetFormat, supportsReasoning, ...) only has to land in one file
+ * instead of drifting out of sync across registries.
+ *
+ * Only entries that are byte-identical across both registries belong here — a model
+ * with tier-specific flags (e.g. go's effort variants, or a flag only one tier needs)
+ * stays local to that registry's own `models` array.
+ */
+export const OPENCODE_ZEN_GO_SHARED_MODELS = Object.freeze([
+ { id: "kimi-k2.7-code", name: "Kimi K2.7 Code" },
+ { id: "qwen3.5-plus", name: "Qwen3.5 Plus", targetFormat: "claude", supportsVision: false },
+ { id: "qwen3.6-plus", name: "Qwen3.6 Plus", targetFormat: "claude", supportsVision: false },
+]);
diff --git a/open-sse/config/providerErrorRules.ts b/open-sse/config/providerErrorRules.ts
index c910e3fb4d91..6f00d2c5f121 100644
--- a/open-sse/config/providerErrorRules.ts
+++ b/open-sse/config/providerErrorRules.ts
@@ -30,21 +30,63 @@ export type ProviderErrorRule = {
export type ProviderErrorRuleMatch = {
reason: ConfiguredErrorReason;
/**
- * Intended lock scope. #10334: this field is CONSUMED end-to-end only for
- * providers in `HONORS_RULE_LOCK_SCOPE_PROVIDERS` (agentrouter-exclusive
- * today, gated by `honorsRuleLockScope()`) — for those, `checkFallbackError`
- * surfaces it as `ruleScope` on its return value for the persistence layer
- * to honor instead of re-deriving scope from `hasPerModelQuota()`. For
- * every other provider it remains INFORMATIONAL: `getProviderErrorRuleMatch`
- * callers still read only `reason`/`cooldownMs`, and the actual lock scope
- * is decided independently by each call site. Widening the allowlist is
- * tracked as a follow-up — see `docs/architecture/RESILIENCE_GUIDE.md` §7.
+ * Intended lock scope. #10334: for a BUILT-IN catalog rule, this field is
+ * CONSUMED end-to-end only for providers in `HONORS_RULE_LOCK_SCOPE_PROVIDERS`
+ * (agentrouter-exclusive today, gated by `honorsRuleLockScope()`) — for those,
+ * `checkFallbackError` surfaces it as `ruleScope` on its return value for the
+ * persistence layer to honor instead of re-deriving scope from
+ * `hasPerModelQuota()`. For every other built-in-rule provider it remains
+ * INFORMATIONAL. #11104: an OPERATOR-declared rule (`OperatorProviderErrorRule`)
+ * is exempt from this allowlist — `honorsRuleLockScope()` always returns true
+ * when the provider has one, since the operator already opted in by declaring
+ * the rule. Widening `HONORS_RULE_LOCK_SCOPE_PROVIDERS` itself (for a new
+ * built-in catalog rule) is tracked as a follow-up — see
+ * `docs/architecture/RESILIENCE_GUIDE.md` §7.
*/
scope: "model" | "provider" | "connection";
/** Optional explicit cooldown; falls back to the existing per-reason defaults. */
cooldownMs?: number;
};
+/**
+ * Operator-declared per-provider error rule (settings-driven).
+ *
+ * Mirrors the catalog `ProviderErrorRule` but is data-only so an operator can
+ * add a scope/cooldown/reason override for a provider without editing this
+ * file. `match` is a plain case-insensitive SUBSTRING of the error body — never
+ * a RegExp — so an operator-supplied pattern can never introduce a ReDoS on the
+ * error-classification hot path. Bounded to <= 50 rules total by the settings
+ * schema. An operator rule is consulted BEFORE the built-in `providerRuleRegistry`
+ * and wins on the first status+substring match for a provider.
+ */
+export type OperatorProviderErrorRule = {
+ status: number;
+ match: string;
+ scope: "model" | "provider" | "connection";
+ reason?: ConfiguredErrorReason;
+ cooldownMs?: number;
+};
+
+let operatorProviderErrorRules: Record = {};
+
+/**
+ * Inject operator-declared rules. Called from the runtime-settings applier
+ * (`applyRuntimeSettings`) once at boot and on every settings update, with the
+ * value validated by the settings schema. Pass `undefined`/empty/null to clear.
+ * Provider keys are lowercased so lookups are case-insensitive.
+ */
+export function setOperatorProviderErrorRules(
+ rules: Record | undefined | null
+): void {
+ operatorProviderErrorRules = {};
+ if (!rules) return;
+ for (const [provider, list] of Object.entries(rules)) {
+ if (Array.isArray(list) && list.length > 0) {
+ operatorProviderErrorRules[provider.toLowerCase()] = list;
+ }
+ }
+}
+
// ─── Opencode ───────────────────────────────────────────────────────────────────
// Opencode Go uses an account-wide quota. The body usually says "rate limit
// reached" but the presence of `x-ratelimit-remaining-requests: 0` is the
@@ -272,11 +314,21 @@ export const providerRuleRegistry = new Map([
* FULL_TEXT_RULE_PROVIDERS: that set controls what body a rule matches against
* (input), this one controls whether the matched scope changes caller behavior
* (output). A provider could need one without the other.
+ *
+ * Providers with an operator-declared rule (`setOperatorProviderErrorRules`)
+ * are honored too, without being added here: the allowlist exists to gate
+ * BUILT-IN catalog rules, which change default behavior for every operator
+ * running that provider — an operator rule is already an explicit, per-operator
+ * opt-in, so gating it a second time behind this list would make the settings
+ * mechanism (#11104) silently inert for every provider except the ones listed
+ * below. See `hasOperatorRuleForProvider`.
*/
const HONORS_RULE_LOCK_SCOPE_PROVIDERS = new Set(["agentrouter"]);
export function honorsRuleLockScope(provider: string | null | undefined): boolean {
- return !!provider && HONORS_RULE_LOCK_SCOPE_PROVIDERS.has(provider.toLowerCase());
+ if (!provider) return false;
+ const key = provider.toLowerCase();
+ return HONORS_RULE_LOCK_SCOPE_PROVIDERS.has(key) || hasOperatorRuleForProvider(key);
}
/**
@@ -310,28 +362,51 @@ export function egressBucketedLockProviders(): string[] {
}
/**
- * Providers whose rules match on the FULL upstream error text.
- * checkFallbackError's rule lookup normally passes only the structured
+ * Providers whose BUILT-IN catalog rules match on the FULL upstream error
+ * text. checkFallbackError's rule lookup normally passes only the structured
* error ({code, type} — message stripped by the combo callers), which is
* enough for header/status/code rules but blind to body-text markers like
* agentrouter's "额度不足". Providers in this set get the raw error text as
* the match body instead. EXCLUSIVE allowlist by owner decision (2026-08-13):
* adding a provider here is an explicit opt-in — the default path for every
* other provider must remain byte-for-byte unchanged.
+ *
+ * Operator-declared rules bypass this allowlist entirely (see
+ * `hasOperatorRuleForProvider`): the operator's `match` is a literal substring
+ * of the error body by construction, so a rule that never sees body text could
+ * never match anything, defeating the point of declaring it.
*/
const FULL_TEXT_RULE_PROVIDERS = new Set(["agentrouter"]);
+/**
+ * True when an operator has declared at least one rule for this provider via
+ * `settings.providerErrorRules` (injected through `setOperatorProviderErrorRules`).
+ * Presence of the rule IS the opt-in — no separate allowlist to maintain, and
+ * no widening decision needed as new operators configure new providers.
+ */
+export function hasOperatorRuleForProvider(provider: string | null | undefined): boolean {
+ if (!provider) return false;
+ const rules = operatorProviderErrorRules[provider.toLowerCase()];
+ return !!rules && rules.length > 0;
+}
+
/**
* Resolve the body handed to getProviderErrorRuleMatch inside
- * checkFallbackError: full error text for FULL_TEXT_RULE_PROVIDERS,
- * the structured error for everyone else.
+ * checkFallbackError: full error text for FULL_TEXT_RULE_PROVIDERS or any
+ * provider with an operator-declared rule, the structured error for everyone
+ * else.
*/
export function resolveRuleMatchBody(
provider: string | null | undefined,
structuredError: unknown,
errorText: string | null | undefined
): unknown {
- if (provider && FULL_TEXT_RULE_PROVIDERS.has(provider.toLowerCase()) && errorText) {
+ if (
+ provider &&
+ (FULL_TEXT_RULE_PROVIDERS.has(provider.toLowerCase()) ||
+ hasOperatorRuleForProvider(provider)) &&
+ errorText
+ ) {
return errorText;
}
return structuredError ?? null;
@@ -346,10 +421,32 @@ export function getProviderErrorRuleMatch(
provider: string | null | undefined,
status: number,
headers: Headers | Record | null | undefined,
- body?: unknown
+ body?: unknown,
+ operatorRules?: Record
): ProviderErrorRuleMatch | null {
if (!provider) return null;
- const rules = providerRuleRegistry.get(provider.toLowerCase());
+ const key = provider.toLowerCase();
+
+ // Operator-declared rules win first: an operator can override any catalog
+ // rule for a provider without editing this file. `operatorRules` is the
+ // injected source (tests / direct callers); when omitted we fall back to the
+ // settings-backed cache populated by `setOperatorProviderErrorRules`.
+ const opRules = (operatorRules ?? operatorProviderErrorRules)?.[key];
+ if (opRules && opRules.length > 0) {
+ const text = typeof body === "string" ? body : JSON.stringify(body ?? "");
+ const lowered = text.toLowerCase();
+ for (const r of opRules) {
+ if (r.status === status && lowered.includes(r.match.toLowerCase())) {
+ return {
+ reason: r.reason ?? "quota_exhausted",
+ scope: r.scope,
+ cooldownMs: r.cooldownMs,
+ };
+ }
+ }
+ }
+
+ const rules = providerRuleRegistry.get(key);
if (!rules) return null;
// Normalize headers: accept either a `Headers` object (from `fetch()`) or
// a plain record. Provider rules access headers via plain object indexing.
diff --git a/open-sse/config/providerRegistry.ts b/open-sse/config/providerRegistry.ts
index bb3b6e0f9fe3..69841c055ce1 100644
--- a/open-sse/config/providerRegistry.ts
+++ b/open-sse/config/providerRegistry.ts
@@ -10,6 +10,10 @@ export {
} from "./providers/registry/alibaba/index.ts";
export { REGISTRY } from "./providers/index.ts";
import { REGISTRY } from "./providers/index.ts";
+// Imported from `privateHost` rather than `outboundUrlGuard`: this module is reachable from
+// `ProviderDetailPageClient.tsx`, so anything it pulls in has to survive a browser bundle
+// (#11122). `privateHost` is platform-free by contract; the guard module is not.
+import { isPrivateHost } from "@/shared/network/privateHost";
import {
RegistryModel,
REASONING_UNSUPPORTED,
@@ -132,11 +136,8 @@ export function isLocalProvider(baseUrl?: string | null): boolean {
try {
const url = new URL(baseUrl);
const hostname = url.hostname;
- // Strictly matching 172.16.0.0/12 (Docker/local) and explicitly blocking ::1 per SSRF hardening
- return (
- LOCAL_HOSTNAMES.has(hostname) ||
- /^172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}$/.test(hostname)
- );
+ if (!hostname) return false;
+ return LOCAL_HOSTNAMES.has(hostname) || isPrivateHost(hostname);
} catch {
return false;
}
diff --git a/open-sse/config/providers/index.ts b/open-sse/config/providers/index.ts
index 00861b24225d..b0135fa52429 100644
--- a/open-sse/config/providers/index.ts
+++ b/open-sse/config/providers/index.ts
@@ -70,7 +70,6 @@ import { togetherProvider } from "./registry/together/index.ts";
import { cohereProvider } from "./registry/cohere/index.ts";
import { cursorProvider, cursor_apiProvider } from "./registry/cursor/index.ts";
import { volcengineProvider } from "./registry/volcengine/index.ts";
-import { hackclubProvider } from "./registry/hackclub/index.ts";
import { freetheaiProvider } from "./registry/freetheai/index.ts";
import { g4f_groqProvider } from "./registry/g4f-groq/index.ts";
import { g4f_geminiProvider } from "./registry/g4f-gemini/index.ts";
@@ -336,7 +335,6 @@ export const REGISTRY: Record = {
cursor: cursorProvider,
"cursor-api": cursor_apiProvider,
volcengine: volcengineProvider,
- hackclub: hackclubProvider,
freetheai: freetheaiProvider,
"g4f-groq": g4f_groqProvider,
"g4f-gemini": g4f_geminiProvider,
diff --git a/open-sse/config/providers/registry/blackbox/index.ts b/open-sse/config/providers/registry/blackbox/index.ts
index 87d0ce26d721..46f58d35be62 100644
--- a/open-sse/config/providers/registry/blackbox/index.ts
+++ b/open-sse/config/providers/registry/blackbox/index.ts
@@ -5,6 +5,12 @@ export const blackboxProvider: RegistryEntry = {
alias: "bb",
format: "openai",
executor: "default",
+ // NOTE: api.blackbox.ai returns HTTP 404 on /v1/chat/completions and /v1/models
+ // (empty body, all path variants) since sweep 2026-08-21; the public inference
+ // surface has moved to the gated enterprise.blackbox.ai/v1 endpoint. The provider
+ // is marked deprecated in src/shared/constants/providers/apikey/frontier-labs.ts —
+ // this registry entry is kept intact (registration/execution unaffected), so
+ // existing configured keys keep working if a restored/enterprise host is reachable.
baseUrl: "https://api.blackbox.ai/v1/chat/completions",
modelsUrl: "https://api.blackbox.ai/v1/models",
authType: "apikey",
diff --git a/open-sse/config/providers/registry/cline/index.ts b/open-sse/config/providers/registry/cline/index.ts
index 21e8c600ed09..aecf811f193b 100644
--- a/open-sse/config/providers/registry/cline/index.ts
+++ b/open-sse/config/providers/registry/cline/index.ts
@@ -27,7 +27,7 @@ export const clineProvider: RegistryEntry = {
// the official free bucket and text-output models advertised as zero-cost.
models: [
{
- id: "zai/glm-5.2",
+ id: "z-ai/glm-5.2",
name: "GLM 5.2",
toolCalling: true,
supportsReasoning: true,
diff --git a/open-sse/config/providers/registry/command-code/index.ts b/open-sse/config/providers/registry/command-code/index.ts
index 77b08ab8ce80..f298bcc21fb8 100644
--- a/open-sse/config/providers/registry/command-code/index.ts
+++ b/open-sse/config/providers/registry/command-code/index.ts
@@ -8,7 +8,11 @@ export const command_codeProvider: RegistryEntry = {
format: "openai",
executor: "command-code",
baseUrl: "https://api.commandcode.ai",
- chatPath: "/alpha/generate",
+ // Chat uses the documented /provider/v1/chat/completions (OpenAI-format)
+ // endpoint — NOT the CLI-only /alpha/generate endpoint, which Command Code
+ // version-gates and proxy-blocks for external callers (#10265). Discovery
+ // already targets the sibling /provider/v1/models endpoint.
+ chatPath: "/provider/v1/chat/completions",
modelsUrl: "https://api.commandcode.ai/provider/v1/models",
// The discovery response is a partial routing catalog; static registry
// entries omitted from it can still be accepted by the gateway.
diff --git a/open-sse/config/providers/registry/dify/index.ts b/open-sse/config/providers/registry/dify/index.ts
index de1d5b03cc54..80c9c7690fbe 100644
--- a/open-sse/config/providers/registry/dify/index.ts
+++ b/open-sse/config/providers/registry/dify/index.ts
@@ -5,7 +5,11 @@ export const difyProvider: RegistryEntry = {
alias: "dify",
format: "openai",
executor: "default",
- baseUrl: "https://api.dify.ai/v1/chat/completions",
+ // Dify does not serve /chat/completions — its native completion route is
+ // POST /v1/chat-messages (validated via the dedicated dify validator, #11002).
+ // Keep this as the bare API root so route suffixes build correctly and
+ // self-hosted instances can override the base URL per connection.
+ baseUrl: "https://api.dify.ai",
authType: "apikey",
authHeader: "bearer",
models: [{ id: "auto", name: "Auto" }],
diff --git a/open-sse/config/providers/registry/hackclub/index.ts b/open-sse/config/providers/registry/hackclub/index.ts
deleted file mode 100644
index 272ee5f86caa..000000000000
--- a/open-sse/config/providers/registry/hackclub/index.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import type { RegistryEntry } from "../../shared.ts";
-
-export const hackclubProvider: RegistryEntry = {
- id: "hackclub",
- alias: "hc",
- format: "openai",
- executor: "default",
- baseUrl: "https://ai.hackclub.com/proxy/v1/chat/completions",
- modelsUrl: "https://ai.hackclub.com/proxy/v1/models",
- authType: "optional",
- authHeader: "bearer",
- passthroughModels: true,
- defaultContextLength: 128000,
- models: [
- { id: "meta-llama/llama-3.3-70b-instruct", name: "Llama 3.3 70B" },
- { id: "mistralai/mistral-7b-instruct", name: "Mistral 7B" },
- { id: "deepseek-ai/deepseek-coder-33b", name: "DeepSeek Coder 33B" },
- ],
-};
diff --git a/open-sse/config/providers/registry/kimi/web/index.ts b/open-sse/config/providers/registry/kimi/web/index.ts
index 4344194974a0..ddeea4350baa 100644
--- a/open-sse/config/providers/registry/kimi/web/index.ts
+++ b/open-sse/config/providers/registry/kimi/web/index.ts
@@ -12,10 +12,9 @@ export const kimi_webProvider: RegistryEntry = {
alias: "kimi-web",
format: "openai",
executor: "kimi-web",
- // International consumer chat — the legacy `kimi.moonshot.cn` domain now
- // redirects every non-CN visitor to www.kimi.com, which speaks a different
- // Connect-RPC API. See `open-sse/executors/kimi-web.ts` for the wire format.
- baseUrl: "https://www.kimi.com",
+ // International consumer chat — Connect-RPC API at www.kimi.ai.
+ // See `open-sse/executors/kimi-web.ts` for the wire format.
+ baseUrl: "https://www.kimi.ai",
authType: "apikey",
authHeader: "Authorization",
// Curated-only catalog. Agent Swarm is excluded because it requires Kimi's
diff --git a/open-sse/config/providers/registry/minimax/web/index.ts b/open-sse/config/providers/registry/minimax/web/index.ts
index 53ac1e6fe3fe..6c2addc043b9 100644
--- a/open-sse/config/providers/registry/minimax/web/index.ts
+++ b/open-sse/config/providers/registry/minimax/web/index.ts
@@ -16,7 +16,7 @@ export const hailuo_webProvider: RegistryEntry = {
alias: "hailuo-web",
format: "openai",
executor: "hailuo-web",
- baseUrl: "https://www.hailuo.ai",
+ baseUrl: "https://chat.minimax.io",
authType: "apikey",
authHeader: "bearer",
models: HAILUO_WEB_STATIC_MODELS,
diff --git a/open-sse/config/providers/registry/opencode/go/index.ts b/open-sse/config/providers/registry/opencode/go/index.ts
index bf0c94ed90bc..abebd92c0fc6 100644
--- a/open-sse/config/providers/registry/opencode/go/index.ts
+++ b/open-sse/config/providers/registry/opencode/go/index.ts
@@ -1,4 +1,5 @@
import type { RegistryEntry } from "../../../shared.ts";
+import { OPENCODE_ZEN_GO_SHARED_MODELS } from "../../../shared.ts";
export const opencode_goProvider: RegistryEntry = {
id: "opencode-go",
@@ -23,9 +24,13 @@ export const opencode_goProvider: RegistryEntry = {
{ id: "glm-5.2", name: "GLM-5.2", supportsReasoning: true },
{ id: "glm-5.2-high", name: "GLM-5.2 (high effort)", supportsReasoning: true },
{ id: "glm-5.2-max", name: "GLM-5.2 (max effort)", supportsReasoning: true },
+
+ ...OPENCODE_ZEN_GO_SHARED_MODELS,
+ // models[0] (glm-5.2) is the dashboard default (LlmChatCard/ProviderTestSlideOver take models[0]).
+
{ id: "glm-5.1", name: "GLM-5.1" },
{ id: "glm-5", name: "GLM-5" },
- { id: "kimi-k2.7-code", name: "Kimi K2.7 Code" },
+ // kimi-k2.7-code declared identically on opencode-zen — see OPENCODE_ZEN_GO_SHARED_MODELS.
{ id: "kimi-k2.6", name: "Kimi K2.6" },
{ id: "kimi-k2.5", name: "Kimi K2.5" },
// #8353: Kimi K3 base + max-effort alias from the OpenCode Go registry.
@@ -89,7 +94,8 @@ export const opencode_goProvider: RegistryEntry = {
supportsVision: false,
supportsReasoning: true,
},
- { id: "qwen3.6-plus", name: "Qwen3.6 Plus", targetFormat: "claude", supportsVision: false },
+ // qwen3.6-plus / qwen3.5-plus base ids declared identically on opencode-zen — see
+ // OPENCODE_ZEN_GO_SHARED_MODELS.
{
id: "qwen3.6-plus-high",
name: "Qwen3.6 Plus (high effort)",
@@ -104,7 +110,6 @@ export const opencode_goProvider: RegistryEntry = {
supportsVision: false,
supportsReasoning: true,
},
- { id: "qwen3.5-plus", name: "Qwen3.5 Plus", targetFormat: "claude", supportsVision: false },
// #8353: hy3 is the Go-tier base id (distinct from hy3-preview / hy3-free).
{ id: "hy3", name: "Hunyuan3", contextLength: 256000, supportsReasoning: true },
{
@@ -138,6 +143,7 @@ export const opencode_goProvider: RegistryEntry = {
supportsVision: true,
supportsAudio: true,
supportsVideo: true,
+ targetFormat: "openai-responses",
},
{
id: "muse-spark-1.2-contributor-minimal",
@@ -148,6 +154,7 @@ export const opencode_goProvider: RegistryEntry = {
supportsVision: true,
supportsAudio: true,
supportsVideo: true,
+ targetFormat: "openai-responses",
},
{
id: "muse-spark-1.2-contributor-low",
@@ -158,6 +165,7 @@ export const opencode_goProvider: RegistryEntry = {
supportsVision: true,
supportsAudio: true,
supportsVideo: true,
+ targetFormat: "openai-responses",
},
{
id: "muse-spark-1.2-contributor-medium",
@@ -168,6 +176,7 @@ export const opencode_goProvider: RegistryEntry = {
supportsVision: true,
supportsAudio: true,
supportsVideo: true,
+ targetFormat: "openai-responses",
},
{
id: "muse-spark-1.2-contributor-high",
@@ -178,6 +187,7 @@ export const opencode_goProvider: RegistryEntry = {
supportsVision: true,
supportsAudio: true,
supportsVideo: true,
+ targetFormat: "openai-responses",
},
{
id: "muse-spark-1.2-contributor-xhigh",
@@ -188,6 +198,7 @@ export const opencode_goProvider: RegistryEntry = {
supportsVision: true,
supportsAudio: true,
supportsVideo: true,
+ targetFormat: "openai-responses",
},
// #8353: Grok 4.5 + effort tiers from the OpenCode Go registry.
{ id: "grok-4.5", name: "Grok 4.5", supportsReasoning: true },
diff --git a/open-sse/config/providers/registry/opencode/zen/index.ts b/open-sse/config/providers/registry/opencode/zen/index.ts
index 73da9c5dc510..9fdca2fc0a5c 100644
--- a/open-sse/config/providers/registry/opencode/zen/index.ts
+++ b/open-sse/config/providers/registry/opencode/zen/index.ts
@@ -1,4 +1,5 @@
import type { RegistryEntry } from "../../../shared.ts";
+import { OPENCODE_ZEN_GO_SHARED_MODELS } from "../../../shared.ts";
export const opencode_zenProvider: RegistryEntry = {
id: "opencode-zen",
@@ -25,6 +26,10 @@ export const opencode_zenProvider: RegistryEntry = {
supportsReasoning: true,
interleavedField: "reasoning_content",
},
+
+ ...OPENCODE_ZEN_GO_SHARED_MODELS,
+ // models[0] (big-pickle) is the dashboard default; SHARED spread kept after it.
+
{ id: "gpt-5.6-sol", name: "GPT 5.6 Sol" },
{ id: "gpt-5.6-terra", name: "GPT 5.6 Terra" },
{ id: "gpt-5.6-luna", name: "GPT 5.6 Luna" },
@@ -51,7 +56,27 @@ export const opencode_zenProvider: RegistryEntry = {
{ id: "grok-4.6", name: "Grok 4.6" },
// ── Muse ───────────────────────────────────────────────────
- { id: "muse-spark-1.2", name: "Muse Spark 1.2" },
+ // Muse Spark is served by OpenCode Zen only on the OpenAI Responses API
+ // endpoint, not /chat/completions (see the opencode provider's own
+ // muse-spark entries, #10874/#10867) — this provider is a separate
+ // registry entry for the same upstream and never got the same
+ // targetFormat declaration, so requests routed here still hit
+ // /chat/completions with a mismatched or unanswerable body and the
+ // upstream returns an empty message.
+ {
+ id: "muse-spark-1.2",
+ name: "Muse Spark 1.2",
+ supportsReasoning: true,
+ targetFormat: "openai-responses",
+ },
+ // Explicit wire-format overlay of the base opencode provider's muse-spark entry
+ // (targetFormat: openai-responses). Keep in sync with base on catalog syncs.
+ {
+ id: "muse-spark-1.2-contributor-free",
+ name: "Muse Spark 1.2 Contributor Free",
+ supportsReasoning: true,
+ targetFormat: "openai-responses",
+ },
// ── DeepSeek ────────────────────────────────────────────────
{ id: "deepseek-v4-pro", name: "DeepSeek V4 Pro" },
@@ -66,7 +91,7 @@ export const opencode_zenProvider: RegistryEntry = {
// ── Kimi / Moonshot ────────────────────────────────────────
{ id: "kimi-k3", name: "Kimi K3" },
- { id: "kimi-k2.7-code", name: "Kimi K2.7 Code" },
+ // kimi-k2.7-code declared identically on opencode-go — see OPENCODE_ZEN_GO_SHARED_MODELS.
// ── Qwen ───────────────────────────────────────────────────
// Issue #2292: Qwen models return Claude-format SSE bodies even
@@ -74,8 +99,8 @@ export const opencode_zenProvider: RegistryEntry = {
// through /messages and the Claude translator.
// Issue #2822: These models are text-only — supportsVision: false
// ensures combo routing skips them on image-bearing requests.
- { id: "qwen3.5-plus", name: "Qwen3.5 Plus", targetFormat: "claude", supportsVision: false },
- { id: "qwen3.6-plus", name: "Qwen3.6 Plus", targetFormat: "claude", supportsVision: false },
+ // qwen3.5-plus / qwen3.6-plus declared identically on opencode-go — see
+ // OPENCODE_ZEN_GO_SHARED_MODELS.
// ── Free Tier ──────────────────────────────────────────────
// #6998 (2026-07-14): upstream free tier rotated — minimax-m2.5-free,
diff --git a/open-sse/config/providers/registry/zcode/index.ts b/open-sse/config/providers/registry/zcode/index.ts
index cd2a4eece64c..65e2e1c3d3d9 100644
--- a/open-sse/config/providers/registry/zcode/index.ts
+++ b/open-sse/config/providers/registry/zcode/index.ts
@@ -1,6 +1,17 @@
import type { RegistryEntry } from "../../shared.ts";
import { GLM_SHARED_MODELS } from "../../../glmProvider.ts";
+const GLM_EXECUTOR_EFFORT_ALIASES = new Set([
+ "glm-5.3-high",
+ "glm-5.3-low",
+ "glm-5.2-high",
+ "glm-5.2-max",
+]);
+
+export const ZCODE_MODELS = GLM_SHARED_MODELS.filter(
+ (model) => !GLM_EXECUTOR_EFFORT_ALIASES.has(model.id)
+).map((model) => ({ ...model, supportedThinkingEfforts: [] }));
+
/**
* Local ZCode app-server backend. Authentication remains in the user's local
* ZCode profile (`builtin:zai-coding-plan`); OmniRoute does not receive or
@@ -14,5 +25,7 @@ export const zcodeProvider: RegistryEntry = {
baseUrl: "zcode://app-server/stdio",
authType: "none",
authHeader: "none",
- models: [...GLM_SHARED_MODELS],
+ // ZCode's app-server transport does not consume reasoning_effort; keep thinking
+ // capability metadata without advertising aliases or tiers that it would ignore.
+ models: ZCODE_MODELS,
};
diff --git a/open-sse/config/providers/shared.ts b/open-sse/config/providers/shared.ts
index d87250644dcb..62909a528d59 100644
--- a/open-sse/config/providers/shared.ts
+++ b/open-sse/config/providers/shared.ts
@@ -25,6 +25,7 @@ import {
GLMT_TIMEOUT_MS,
GLM_SHARED_MODELS,
} from "../glmProvider.ts";
+import { OPENCODE_ZEN_GO_SHARED_MODELS } from "../opencodeZenGoSharedModels.ts";
import { MARITALK_DEFAULT_BASE_URL } from "../maritalk.ts";
import {
CURSOR_REGISTRY_VERSION,
@@ -719,6 +720,7 @@ export {
GLM_TIMEOUT_MS,
GLMT_TIMEOUT_MS,
GLM_SHARED_MODELS,
+ OPENCODE_ZEN_GO_SHARED_MODELS,
MARITALK_DEFAULT_BASE_URL,
CURSOR_REGISTRY_VERSION,
getAntigravityProviderHeaders,
diff --git a/open-sse/config/searchRegistry.ts b/open-sse/config/searchRegistry.ts
index b3ab36ccd944..28136655fe29 100644
--- a/open-sse/config/searchRegistry.ts
+++ b/open-sse/config/searchRegistry.ts
@@ -10,6 +10,8 @@
* perplexity-search reuses credentials from the "perplexity" chat provider.
*/
+import { isProviderBlockedByIdOrAlias } from "@/shared/utils/noAuthProviders";
+
export interface SearchProviderConfig {
id: string;
name: string;
@@ -394,16 +396,18 @@ export function supportsSearchType(
/**
* Get all search providers as a flat list
*/
-export function getAllSearchProviders(): Array<{
+export function getAllSearchProviders(blockedProviders: string[] = []): Array<{
id: string;
name: string;
searchTypes: string[];
}> {
- return Object.values(SEARCH_PROVIDERS).map((p) => ({
- id: p.id,
- name: p.name,
- searchTypes: p.searchTypes,
- }));
+ return Object.values(SEARCH_PROVIDERS)
+ .filter((p) => !p.disabled && !isProviderBlockedByIdOrAlias(p.id, blockedProviders))
+ .map((p) => ({
+ id: p.id,
+ name: p.name,
+ searchTypes: p.searchTypes,
+ }));
}
/**
diff --git a/open-sse/executors/accountRotation.ts b/open-sse/executors/accountRotation.ts
index a64321e83d24..67115bdd8d03 100644
--- a/open-sse/executors/accountRotation.ts
+++ b/open-sse/executors/accountRotation.ts
@@ -1,7 +1,7 @@
/**
* Shared multi-account rotation mechanics for noauth executors that round-robin
* across several "accounts" (fingerprints), each with an optional dedicated
- * proxy — currently `OpencodeExecutor` and `MimocodeExecutor`.
+ * proxy — currently `OpencodeExecutor`.
*
* Extracted after both executors independently implemented the same
* pickAccount/markCooldown/markSuccess skeleton with the same exponential
@@ -120,3 +120,58 @@ export function maskAccountId(fingerprint: string): string {
export function isNetworkErrorRotatable(account: RotatableAccount): boolean {
return account.proxy !== null;
}
+
+/**
+ * Detect an *empty* upstream rejection: a 400 whose body carries no usable
+ * completion — the kind `OpencodeExecutor` must rotate/retry on instead of
+ * propagating as a fatal success.
+ *
+ * Signature is deliberately strict and scoped to the observed malformed
+ * envelope (`choices[0].message` with no `error`, no real `content`,
+ * `finish_reason: null`):
+ * - status must be exactly 400 (anything else → false);
+ * - body must parse and contain a `choices` array with at least one entry
+ * holding a `message` object;
+ * - an `error` field (present or empty) → false, so genuine 400s keep
+ * propagating immediately (#10460 precedent: classify by signature before
+ * rotating);
+ * - `tool_calls` / `reasoning_content` → false (real content);
+ * - `message.content` absent / null / "" → eligible; any other value
+ * (non-empty text, number, block array…) → false (conservative);
+ * - a literal `finish_reason` (not null) → false (a completed, if empty, turn).
+ *
+ * Does NOT reuse `detectMalformedNonStream` (diagnostics.ts): that classifier
+ * also flags `{error:{…}}` bodies as `empty_choices`, which would rotate on
+ * real errors — a false-positive class with a history here.
+ */
+export function isEmptyUpstreamRejection(status: number, bodyText: string): boolean {
+ if (status !== 400) return false;
+ let parsed: unknown;
+ try {
+ parsed = JSON.parse(bodyText);
+ } catch {
+ return false;
+ }
+ const choices = (parsed as { choices?: unknown })?.choices;
+ if (!Array.isArray(choices) || choices.length === 0) return false;
+ const first = choices[0] as { message?: unknown; finish_reason?: unknown };
+ if (typeof first !== "object" || first === null) return false;
+ const rawMessage = (first as { message?: unknown }).message;
+ if (typeof rawMessage === "undefined" || rawMessage === null) return false;
+ if (typeof parsed !== "object" || parsed === null) return false;
+ if ("error" in (parsed as Record)) return false;
+ const msg = rawMessage as Record;
+ if ("tool_calls" in msg) return false;
+ if ("reasoning_content" in msg) return false;
+ const content = msg.content;
+ if (content !== undefined && content !== null && content !== "") return false;
+ if (first.finish_reason !== null && first.finish_reason !== undefined) return false;
+ return true;
+}
+
+/** Best-effort extraction of the upstream `chatcmpl_*` id from a response body,
+ * for observability logging. Returns `"unknown"` when absent or unparseable. */
+export function extractChatcmplId(bodyText: string): string {
+ const match = /"id"\s*:\s*"(chatcmpl_[^"]+)"/.exec(bodyText);
+ return match ? match[1] : "unknown";
+}
diff --git a/open-sse/executors/base.ts b/open-sse/executors/base.ts
index 877431b68e5e..1c13442aff03 100644
--- a/open-sse/executors/base.ts
+++ b/open-sse/executors/base.ts
@@ -20,6 +20,10 @@ import {
recordLearnedThinkingCap,
parseThinkingBudgetMax,
} from "../services/learnedThinkingCaps.ts";
+import {
+ recordLearnedReasoningEffort,
+ parseReasoningEffortEnum,
+} from "../services/learnedReasoningEffortCaps.ts";
import {
getParamFilterConfig,
addParamToBlocklist,
@@ -104,6 +108,12 @@ import {
import { applyPeerTraceHeader } from "@/shared/resilience/peerRouting";
import { applyClineProtocolHeaders } from "@/shared/utils/clineAuth";
import { isProbeContext } from "@/shared/utils/probeOrigin";
+import {
+ parseAndValidatePublicUrl,
+ parseAndValidateNonMetadataUrl,
+} from "@/shared/network/outboundUrlGuard";
+import { getProviderValidationGuard } from "@/shared/network/outboundUrlGuardPolicy";
+import { isLocalProvider, isSelfHostedChatProvider } from "@/shared/constants/providers";
// Header helpers extracted to a pure leaf; re-exported for external importers
// (executors + tests) that import them from "./base.ts".
export {
@@ -397,6 +407,29 @@ export class BaseExecutor {
return fallback || this.config.baseUrl || "";
}
+ /**
+ * SSRF guard for the runtime dispatch path (GHSA-4f49-hj64-448x). A persisted,
+ * caller-supplied `providerSpecificData.baseUrl` reaches the fetch() calls
+ * below, so a `manage`-scope actor (or, on a keyless install, an anonymous
+ * one) could point a provider at loopback / internal / cloud-metadata hosts
+ * and exfiltrate the stored upstream key. Mirror the provider VALIDATION
+ * guard so runtime dispatch makes the same decision the validation layer
+ * already makes: local / self-hosted providers are exempt (they legitimately
+ * use private URLs, and the OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS opt-in still
+ * applies through the guard), and for everything else `public-only` mode
+ * blocks private + metadata while the default `block-metadata` mode blocks the
+ * cloud-metadata IMDS pivot. Throws on a blocked URL.
+ */
+ protected assertOutboundUrlAllowed(url: string): void {
+ if (!url) return;
+ if (isLocalProvider(this.provider) || isSelfHostedChatProvider(this.provider)) return;
+ if (getProviderValidationGuard() === "public-only") {
+ parseAndValidatePublicUrl(url);
+ return;
+ }
+ parseAndValidateNonMetadataUrl(url);
+ }
+
/**
* Alternate protocol selected on this connection, if the provider declares one
* that matches. Centralizes the registry lookup so every call-site resolves the
@@ -615,6 +648,7 @@ export class BaseExecutor {
async countTokens({ model, body, credentials, signal, log }: CountTokensInput) {
const url = this.buildCountTokensUrl(model, credentials);
if (!url) return null;
+ this.assertOutboundUrlAllowed(url); // GHSA-4f49
const headers = this.buildHeaders(credentials, false);
const requestBody =
@@ -796,6 +830,9 @@ export class BaseExecutor {
// loop. The learned cap is also recorded process-wide via
// recordLearnedThinkingCap so future requests skip the 400 entirely.
let thinkingBudgetClampedMax: number | null = null;
+ // Set by the reasoning_effort 4xx clamp-and-retry below — guards the same
+ // "fires at most once per URL" invariant as thinkingBudgetClampedMax above.
+ let reasoningEffortClamped = false;
for (let urlIndex = 0; urlIndex < fallbackCount; urlIndex++) {
const requestCredentials = withForcedResponsesUpstream(
@@ -869,6 +906,9 @@ export class BaseExecutor {
// Timeout only covers response start; stream stalls are handled downstream.
const fetchStartTimeoutMs = this.getTimeoutMs();
const fetchWithStartTimeout = async (requestUrl: string, requestOptions: RequestInit) => {
+ // GHSA-4f49: guard here (not only next to the first buildUrl) so retries
+ // and fallback URLs are validated too, before any bytes leave the host.
+ this.assertOutboundUrlAllowed(requestUrl);
const timeoutController = fetchStartTimeoutMs > 0 ? new AbortController() : null;
let timeoutId: ReturnType | null = null;
if (timeoutController) {
@@ -1496,6 +1536,49 @@ export class BaseExecutor {
}
}
+ // Reasoning-effort enum 4xx clamp-and-retry (any provider/model without a
+ // declared reasoning_effort capability — custom OpenAI-compatible
+ // connections, or a registered provider the registry hasn't caught up
+ // with). Mirrors the thinking_budget clamp-and-retry above: parse the
+ // upstream-advertised accepted values, record them process-wide (so
+ // FUTURE requests clamp proactively via sanitizeReasoningEffortForProvider
+ // → getLearnedReasoningEffort), clamp the live transformedBody by
+ // re-running the sanitizer, and retry the same URL once.
+ if (
+ (response.status === HTTP_STATUS.BAD_REQUEST ||
+ response.status === HTTP_STATUS.UNPROCESSABLE_ENTITY) &&
+ !reasoningEffortClamped &&
+ transformedBody &&
+ typeof transformedBody === "object"
+ ) {
+ const errText = await response
+ .clone()
+ .text()
+ .catch(() => "");
+ const acceptedValues = parseReasoningEffortEnum(errText);
+ if (acceptedValues) {
+ reasoningEffortClamped = true;
+ const learned = recordLearnedReasoningEffort(this.provider, model, acceptedValues);
+ if (learned) {
+ transformedBody = sanitizeReasoningEffortForProvider(
+ transformedBody,
+ this.provider,
+ model,
+ log
+ );
+ let retryBody = JSON.stringify(transformedBody);
+ if (usesClaudeCodeProtocol || this.provider === "claude") {
+ retryBody = await signRequestBody(retryBody);
+ }
+ log?.info?.(
+ "REASONING_SANITIZE",
+ `Upstream ${response.status} rejected reasoning_effort on ${url} — clamped to ${learned} and retrying (learned for ${this.provider}/${model})`
+ );
+ response = await fetchWithStartTimeout(url, { ...fetchOptions, body: retryBody });
+ }
+ }
+ }
+
// Generic reactive 400 field-downgrade; each field is stripped at most once.
if (
response.status === HTTP_STATUS.BAD_REQUEST &&
diff --git a/open-sse/executors/base/reasoningEffort.ts b/open-sse/executors/base/reasoningEffort.ts
index fa416dbc1a80..8dd99904fd6e 100644
--- a/open-sse/executors/base/reasoningEffort.ts
+++ b/open-sse/executors/base/reasoningEffort.ts
@@ -8,6 +8,10 @@ import {
getProviderModel,
getProviderModels,
} from "../../config/providerModels.ts";
+import {
+ getLearnedReasoningEffort,
+ REASONING_EFFORT_ORDER,
+} from "../../services/learnedReasoningEffortCaps.ts";
/**
* Sanitize reasoning_effort for providers that don't accept all values.
@@ -338,10 +342,24 @@ export function sanitizeReasoningEffortForProvider(
const supportsXHigh = supportsXHighEffort(provider, modelStr);
const supportsMax = supportsMaxEffortForProvider(provider, modelStr);
+ // Highest value we've actually seen this provider+model accept in a real
+ // upstream 4xx (learnedReasoningEffortCaps.ts) — takes priority over the
+ // static registry (which defaults to "supports everything" when there's no
+ // entry, e.g. custom OpenAI-compatible connections) and over the hardcoded
+ // "high" fallback below (which isn't always valid either).
+ const learnedCap = getLearnedReasoningEffort(provider, modelStr);
+ const learnedRank = learnedCap ? REASONING_EFFORT_ORDER.indexOf(learnedCap) : -1;
// ── xhigh handling ──────────────────────────────────────────────────────
// xhigh is OmniRoute-internal. Map it to the best effort the model accepts.
if (effortStr === "xhigh") {
+ if (learnedCap && learnedRank < REASONING_EFFORT_ORDER.indexOf("xhigh")) {
+ log?.info?.(
+ "REASONING_SANITIZE",
+ `${provider}/${modelStr}: clamped reasoning_effort xhigh → ${learnedCap} (learned)`
+ );
+ return writeEffortValue(b, learnedCap, c);
+ }
if (supportsXHigh) return body; // model accepts xhigh natively
if (supportsMax) {
log?.info?.(
@@ -366,6 +384,13 @@ export function sanitizeReasoningEffortForProvider(
// upstream, and if it 400s the user gets a clear signal. This prevents
// new models from being unusable for weeks until they're whitelisted (#8057).
if (effortStr === "max") {
+ if (learnedCap && learnedRank < REASONING_EFFORT_ORDER.indexOf("max")) {
+ log?.info?.(
+ "REASONING_SANITIZE",
+ `${provider}/${modelStr}: clamped reasoning_effort max → ${learnedCap} (learned)`
+ );
+ return writeEffortValue(b, learnedCap, c);
+ }
if (supportsMax) return body; // explicitly known to accept max
// A model that explicitly advertises its accepted tiers is safe to normalize.
diff --git a/open-sse/executors/codex.ts b/open-sse/executors/codex.ts
index e1674c30fb3f..b9f6cf113a29 100644
--- a/open-sse/executors/codex.ts
+++ b/open-sse/executors/codex.ts
@@ -517,10 +517,12 @@ export function filterNonstandardCodexSse(response: Response): Response {
const transform = new TransformStream({
transform(chunk, controller) {
buffer += decoder.decode(chunk, { stream: true });
- let sep: number;
- while ((sep = buffer.indexOf("\n\n")) !== -1) {
- const block = buffer.slice(0, sep + 2);
- buffer = buffer.slice(sep + 2);
+ while (true) {
+ const separator = /\r?\n\r?\n/.exec(buffer);
+ if (!separator) break;
+ const blockEnd = separator.index + separator[0].length;
+ const block = buffer.slice(0, blockEnd);
+ buffer = buffer.slice(blockEnd);
if (!dropBlock(block)) controller.enqueue(encoder.encode(block));
}
},
@@ -1396,7 +1398,6 @@ export class CodexExecutor extends BaseExecutor {
provider: "codex",
preserveEncryptedReasoning:
credentials?.providerSpecificData?.preserveEncryptedReasoning === true,
- onIncompatibleReasoning: "drop",
});
if (nativeCodexPassthrough) {
diff --git a/open-sse/executors/commandCode.ts b/open-sse/executors/commandCode.ts
index b736e6cdf1fa..a1023fc80cd9 100644
--- a/open-sse/executors/commandCode.ts
+++ b/open-sse/executors/commandCode.ts
@@ -1,6 +1,3 @@
-import { randomUUID } from "node:crypto";
-
-import { isVisionModelId } from "@/shared/constants/visionModels";
import { REGISTRY } from "../config/providerRegistry.ts";
import {
BaseExecutor,
@@ -11,407 +8,54 @@ import {
type JsonRecord = Record;
-export const COMMAND_CODE_VERSION = process.env.COMMAND_CODE_VERSION?.trim() || "1.15.1";
-// Hard server-side ceiling enforced by Command Code's /alpha/generate endpoint:
-// any request with params.max_tokens > 200_000 is rejected with a 400
-// "Too big: expected number to be <=200000 at params.max_tokens". We only use
-// this to clamp a CLIENT-SUPPLIED max_tokens down to a value the endpoint will
-// accept; we never fabricate this number for requests that omit the field (see
-// clampMaxTokens / buildCommandCodeBody).
+// Defensive server-side ceiling for a CLIENT-SUPPLIED max_tokens. The official
+// /provider/v1/chat/completions endpoint (documented OpenAI-format surface) is
+// the successor to the CLI-only /alpha/generate endpoint, which rejected any
+// params.max_tokens > 200_000 with a 400. We only clamp a client-supplied value
+// down; we never fabricate this number for requests that omit the field (see
+// clampMaxTokens / buildOpenAiBody).
const MAX_COMMAND_CODE_TOKENS = 200_000;
-const encoder = new TextEncoder();
function isRecord(value: unknown): value is JsonRecord {
return typeof value === "object" && value !== null && !Array.isArray(value);
}
-function asRecordArray(value: unknown): JsonRecord[] {
- return Array.isArray(value) ? value.filter(isRecord) : [];
-}
-
-function stringValue(value: unknown): string | undefined {
- return typeof value === "string" ? value : undefined;
-}
-
function numberValue(value: unknown): number | undefined {
return typeof value === "number" && Number.isFinite(value) ? value : undefined;
}
-function recordOrEmpty(value: unknown): JsonRecord {
- if (isRecord(value)) return value;
- if (typeof value === "string" && value.trim()) {
- try {
- const parsed: unknown = JSON.parse(value);
- if (isRecord(parsed)) return parsed;
- } catch (error) {
- console.warn(
- "[commandCode] tool arg parse failed:",
- error instanceof Error ? error.message : String(error)
- );
- }
- }
- return {};
-}
-
-/**
- * Build the `arguments` field for an assistant tool-call part that Command
- * Code's /alpha/generate schema REQUIRES (rejects a missing field with
- * `missing required field 'arguments'`). Valid source values round-trip:
- * - object arguments -> JSON string of the object
- * - valid JSON string arguments -> the string as-is
- * - missing / empty / invalid JSON string -> "{}" (a valid empty-object string)
- */
-function toolCallArgumentsString(value: unknown): string {
- if (isRecord(value)) return JSON.stringify(value);
- if (typeof value === "string" && value.trim()) {
- try {
- const parsed: unknown = JSON.parse(value);
- if (isRecord(parsed)) return value;
- } catch {
- return "{}";
- }
- return "{}";
- }
- return JSON.stringify(recordOrEmpty(value));
-}
-
-/**
- * Tool names that collide with Command Code's server-side built-in tools.
- * The /alpha/generate server normalizes tool-call/tool-result parts against
- * ITS OWN built-in registry for matching names; for its built-in `tool_search`
- * the result normalization requires `arguments` in a shape we do not send, so
- * the result is rejected with `input[N] missing required field 'arguments'`
- * (verified live 2026-08-10 — renaming the call/result `tool_search` → `grep`
- * makes the identical request pass; the server pairs each tool-result with the
- * nearest preceding tool-call, so any result following such a call is affected).
- * We rename the colliding name consistently on the wire — definitions, calls
- * and results — then un-rename on the response path so the client still sees
- * its original tool names.
- */
-const COMMAND_CODE_RESERVED_TOOL_NAMES = new Set(["tool_search"]);
-
-function wireToolName(clientName: string, toolNameMap: Map): string {
- if (COMMAND_CODE_RESERVED_TOOL_NAMES.has(clientName)) {
- const wire = `omniroute_${clientName}`;
- toolNameMap.set(wire, clientName);
- return wire;
- }
- return clientName;
-}
-
-function clientToolName(wireName: string, toolNameMap: Map): string {
- return toolNameMap.get(wireName) ?? wireName;
-}
-
-function normalizeContentText(content: unknown): string {
- if (typeof content === "string") return content;
- return asRecordArray(content)
- .filter((part) => part.type === "text")
- .map((part) => stringValue(part.text) || "")
- .join("\n");
-}
-
-/**
- * Model id patterns for Command Code models that have `text, vision`
- * capability per the official CC model registry, but are NOT caught
- * by the shared {@link isVisionModelId} heuristic. Kept as a local
- * set because these are CC-specific model IDs (vendor-prefix shapes
- * like "moonshotai/Kimi-K2.6" or CC aliases like "gpt-5.6-luna").
- *
- * Source: Command Code /alpha/generate model registry (docs).
- */
-const CC_VISION_MODEL_PATTERNS: readonly RegExp[] = [
- // Open Source
- /kimi-k2/i, // moonshotai/Kimi-K2.6, Kimi-K2.7-Code, Kimi-K2.5
- /qwen3\.\d/i, // Qwen/Qwen3.6-Plus, Qwen/Qwen3.7-Plus
- /step-?3/i, // stepfun/Step-3.7-Flash
- // Anthropic
- /claude-fable/i, // claude-fable-5 (not covered by claude-opus/sonnet/haiku-4)
- // OpenAI
- /gpt-5/i, // gpt-5.6, gpt-5.5, gpt-5.4, gpt-5.4-mini, gpt-5.3-codex
- // NOTE: gpt-5.4-mini and gpt-5.3-codex deliberately stay inside the `/gpt-5/`
- // family — both accept image input on the OpenAI API, and there is no
- // verified Command Code backend data marking them text-only. Excluding them
- // without evidence would re-create #4071 (image stripped from a model that
- // can see it). Revisit only with per-model CC registry capability data.
- // Sakana
- /fugu/i, // sakana/fugu-ultra
-];
-
-/**
- * Whether a model id routed through the Command Code executor is
- * vision-capable. Checks Mimo-specific rules first, then CC-specific
- * patterns, then falls through to the shared {@link isVisionModelId}
- * heuristic (which covers minimax-m3, claude-3/4 families, gemini,
- * gpt-4o/4.1, mistral-medium-3, and general "-vision" / "multimodal").
- */
-function isCommandCodeVisionModel(model?: string | null): boolean {
- if (!model) return false;
- // mimo-v2.5-pro is text-only — exclude before any positive check
- if (/(?:^|\/)mimo-v2\.5-pro$/i.test(model)) return false;
- // Only mimo-v2.5 and mimo-v2-omni accept images per Xiaomi vendor docs
- if (/(?:^|\/)mimo-v2\.5$/i.test(model)) return true;
- if (/(?:^|\/)mimo-v2-omni$/i.test(model)) return true;
- // CC-specific patterns: Kimi K2, Qwen 3.x, Stepfun, Claude Fable,
- // GPT-5, Sakana Fugu — not covered by the shared heuristic
- if (CC_VISION_MODEL_PATTERNS.some((pattern) => pattern.test(model))) return true;
- // Fall through: minimax-m3, claude-3/4, gemini-2/3, gpt-4o, -vision, multimodal
- return isVisionModelId(model);
-}
-
-/**
- * Extract the image URL from an OpenAI-compatible or Command Code
- * content part, returning undefined for non-image parts.
- *
- * OpenAI-compatible: { type: "image_url", image_url: { url: "..." } }
- * Command Code CLI: { type: "image", image: "..." }
- * AI SDK image: { type: "image", image: "data:...;base64,..." } (#1330)
- * Anthropic image: { type: "image", source: { type: "base64", media_type, data } }
- * or { type: "image", source: { type: "url", url } }
- *
- * The Anthropic-shaped block is common for Claude-Code-compatible clients
- * (e.g. Zoo Code) that send Messages-style content arrays to the
- * OpenAI `/v1/chat/completions` surface. Without this branch the image was
- * silently dropped before reaching the upstream vision model.
- */
-function extractImageUrl(part: JsonRecord): string | undefined {
- if (part.type === "image") {
- const direct = stringValue(part.image);
- if (direct) return direct;
-
- // Anthropic source block: { source: { type: "base64", media_type, data } } or
- // { source: { type: "url", url } }.
- const source = isRecord(part.source) ? part.source : null;
- if (source) {
- if (source.type === "base64") {
- const mediaType = stringValue(source.media_type) || "image/png";
- const data = stringValue(source.data);
- if (data) return `data:${mediaType};base64,${data}`;
- }
- if (source.type === "url") {
- const url = stringValue(source.url);
- if (url) return url;
- }
- }
- return undefined;
- }
- if (part.type === "image_url") {
- if (isRecord(part.image_url)) return stringValue(part.image_url.url);
- return stringValue(part.image_url);
- }
- return undefined;
-}
-
-/**
- * Convert an OpenAI-format content array to Command Code's internal
- * CLI format. For vision-capable models (MiniMax M3, MiMo v2.5, etc.)
- * this also preserves image parts alongside text.
- */
-function convertUserContentParts(content: unknown, isVisionModel: boolean): string | unknown[] {
- // For non-vision models or string content, extract text only.
- if (!isVisionModel || typeof content === "string") {
- return normalizeContentText(content);
- }
-
- const parts: unknown[] = [];
- for (const part of asRecordArray(content)) {
- if (part.type === "text") {
- const text = stringValue(part.text);
- if (text) parts.push({ type: "text", text });
- continue;
- }
- const imgUrl = extractImageUrl(part);
- if (imgUrl) {
- parts.push({ type: "image", image: imgUrl });
- continue;
- }
- // Always drop tool_use / tool_result / thinking parts from user
- // messages (Command Code doesn't accept them for role:"user").
- }
-
- // When every part was stripped, fall back to empty text so the
- // message is still valid JSON (Command Code rejects empty content).
- if (parts.length === 0) parts.push({ type: "text", text: "" });
-
- return parts;
-}
-
-function convertTools(tools: unknown, toolNameMap: Map): unknown[] {
- return asRecordArray(tools).map((tool) => {
- const fn = isRecord(tool.function) ? tool.function : tool;
- return {
- type: "function",
- name: wireToolName(stringValue(fn.name) || "", toolNameMap),
- description: stringValue(fn.description) || "",
- input_schema: isRecord(fn.parameters) ? fn.parameters : {},
- };
- });
-}
-
-function buildToolCallMetadata(
- messages: JsonRecord[],
- toolNameMap: Map
-): {
- pairedToolCallIds: Set;
- toolCallNames: Map;
- toolCallArgs: Map;
-} {
- const callIds = new Set();
- const resultIds = new Set();
- const toolCallNames = new Map();
- const toolCallArgs = new Map();
-
- for (const message of messages) {
- if (message.role === "assistant") {
- for (const call of asRecordArray(message.tool_calls)) {
- const id = stringValue(call.id);
- if (id) {
- callIds.add(id);
- const fn = isRecord(call.function) ? call.function : {};
- const name = stringValue(fn.name) || stringValue(call.name);
- if (name) toolCallNames.set(id, wireToolName(name, toolNameMap));
- toolCallArgs.set(id, toolCallArgumentsString(fn.arguments));
- }
- }
- } else if (message.role === "tool") {
- const id = stringValue(message.tool_call_id);
- if (id) resultIds.add(id);
- }
- }
-
- const pairedToolCallIds = new Set([...callIds].filter((id) => resultIds.has(id)));
- return { pairedToolCallIds, toolCallNames, toolCallArgs };
-}
-
-function convertMessages(
- messages: unknown,
- model?: string | null,
- toolNameMap?: Map
-): { system: string; messages: unknown[] } {
- const source = asRecordArray(messages);
- const { pairedToolCallIds, toolCallNames, toolCallArgs } = buildToolCallMetadata(
- source,
- toolNameMap ?? new Map()
- );
- const out: unknown[] = [];
- const system: string[] = [];
- const isVision = isCommandCodeVisionModel(model);
-
- for (const message of source) {
- const role = stringValue(message.role);
- if (role === "system" || role === "developer") {
- const text = normalizeContentText(message.content);
- if (text) system.push(text);
- continue;
- }
-
- if (role === "user") {
- out.push({ role: "user", content: convertUserContentParts(message.content, isVision) });
- continue;
- }
-
- if (role === "assistant") {
- const parts: unknown[] = [];
- const text = normalizeContentText(message.content);
- if (text) parts.push({ type: "text", text });
-
- for (const call of asRecordArray(message.tool_calls)) {
- const id = stringValue(call.id) || "";
- if (!id || !pairedToolCallIds.has(id)) continue;
- const fn = isRecord(call.function) ? call.function : {};
- const parsedInput = recordOrEmpty(fn.arguments);
- parts.push({
- type: "tool-call",
- toolCallId: id,
- toolName: wireToolName(
- stringValue(fn.name) || stringValue(call.name) || "unknown",
- toolNameMap ?? new Map()
- ),
- input: parsedInput,
- // /alpha/generate requires this field on assistant tool-call parts;
- // a missing one is rejected with `missing required field 'arguments'`.
- arguments: toolCallArgumentsString(fn.arguments),
- });
- }
-
- if (parts.length > 0) out.push({ role: "assistant", content: parts });
- continue;
- }
-
- if (role === "tool") {
- const toolCallId = stringValue(message.tool_call_id) || "";
- if (!toolCallId || !pairedToolCallIds.has(toolCallId)) continue;
- const toolName = wireToolName(
- stringValue(message.name) || toolCallNames.get(toolCallId) || "unknown",
- toolNameMap ?? new Map()
- );
- out.push({
- role: "tool",
- content: [
- {
- type: "tool-result",
- toolCallId,
- toolName,
- // /alpha/generate requires `arguments` here too (same rejection as
- // tool-call parts); echo the paired call's args, defensively "{}".
- arguments: toolCallArgs.get(toolCallId) ?? "{}",
- output: { type: "text", value: normalizeContentText(message.content) },
- },
- ],
- });
- }
- }
-
- return { system: system.join("\n\n"), messages: out };
-}
-
// Clamp a client-supplied max_tokens to the endpoint ceiling, mirroring the
// provider-driven clamp in antigravity.ts: we only intervene when the value is
-// present, positive AND would otherwise be rejected (> 200_000). A valid value
-// is returned floored; anything absent, non-numeric or non-positive returns
-// undefined so the caller can OMIT the field entirely and let Command Code's
-// upstream apply the model's own native default (rather than us inventing a
-// number). A non-positive value such as Zoo Code's max_tokens:-1 ("let the
-// server choose") must be omitted, NOT forced to 1 — the old Math.max(1,...)
-// truncated output to a single token (#5166).
+// present, positive AND would otherwise be rejected (> MAX_COMMAND_CODE_TOKENS).
+// A valid value is returned floored; anything absent, non-numeric or non-positive
+// returns undefined so the caller can OMIT the field entirely and let the
+// provider's upstream apply the model's own native default (rather than us
+// inventing a number). A non-positive value such as Zoo Code's max_tokens:-1
+// ("let the server choose") must be omitted, NOT forced to 1 — the old
+// Math.max(1,...) truncated output to a single token (#5166).
function clampMaxTokens(value: unknown): number | undefined {
const numeric = numberValue(value);
if (numeric === undefined || numeric <= 0) return undefined;
return Math.min(Math.floor(numeric), MAX_COMMAND_CODE_TOKENS);
}
-// Reasoning/thinking fields that payload rules or clients may inject and that
-// CommandCode's upstream accepts inside `params`. Without this pass-through,
-// payload-rule overrides on these fields are silently dropped (#2986 follow-up).
-const COMMAND_CODE_PASSTHROUGH_FIELDS = [
- "reasoning_effort",
- "reasoning",
- "thinking",
- "effort",
- "output_config",
- "extra_body",
-] as const;
-
/**
- * Command Code's /alpha/generate endpoint serves most models under a
- * vendor-prefixed wire id (e.g. `xiaomi/mimo-v2.5`, `deepseek/deepseek-v4-pro`,
- * `moonshotai/Kimi-K2.6`) and defaults an unprefixed id to the `anthropic:`
- * provider, which 403s with "Model/provider not recognized: anthropic:".
+ * Command Code serves most models under a vendor-prefixed wire id (e.g.
+ * `xiaomi/mimo-v2.5`, `deepseek/deepseek-v4-pro`, `moonshotai/Kimi-K2.6`).
* The command-code registry ids already carry the vendor prefix, so a bare id
* reaching the executor is an operator-set custom model (e.g. the Vision Bridge
* picker, #10809). Map the small set of documented bare ids to their
* vendor-prefixed wire form; anything with an explicit `/` (or already wired)
- * passes through untouched. Kept minimal and doc-backed, mirroring the
- * `CC_VISION_MODEL_PATTERNS` philosophy.
+ * passes through untouched. Kept minimal and doc-backed.
*/
const COMMAND_CODE_BARE_MODEL_VENDOR_PREFIX: Readonly> = {
- // Xiaomi MiMo V2.5 — the only CC-served vision model not in the registry.
+ // Xiaomi MiMo V2.5 — a CC-served vision model not in the registry.
"mimo-v2.5": "xiaomi/mimo-v2.5",
"mimo-v2.5-pro": "xiaomi/mimo-v2.5-pro",
};
/**
- * Normalize an incoming model id to the wire form Command Code's upstream
+ * Normalize an incoming model id to the wire form Command Code's provider API
* accepts. Strips a leading provider prefix (`command-code/` / `cmd/`) that the
* pipeline may have resolved, then maps known bare ids to their
* vendor-prefixed form (see above).
@@ -424,546 +68,47 @@ function normalizeCommandCodeWireModel(model: string): string {
return COMMAND_CODE_BARE_MODEL_VENDOR_PREFIX[bare] ?? bare;
}
-function buildCommandCodeBody(
+/**
+ * Build a flat OpenAI chat.completions request body for the official
+ * /provider/v1/chat/completions endpoint. The incoming body is already the
+ * standard OpenAI chat.completions shape (registry `format: "openai"`), so this
+ * is a passthrough that: normalizes the wire model id, forces the stream flag
+ * to match the caller's expectation, clamps max_tokens, and lets reasoning /
+ * payload-rule passthrough fields flow through untouched. No CLI envelope
+ * (config/memory/taste/skills/permissionMode) and no CLI-shaped message
+ * conversion here — /provider/v1 is the documented, standard API.
+ */
+function buildOpenAiBody(
model: string,
body: unknown,
- stream = false
-): { body: JsonRecord; toolNameMap: Map } {
- const input = isRecord(body) ? body : {};
- const toolNameMap = new Map();
+ stream: boolean
+): { body: JsonRecord } {
+ const input = isRecord(body) ? { ...(body as JsonRecord) } : {};
- // Payload rules may rewrite `body.model` (e.g. deepseek-v4-pro-max →
- // deepseek/deepseek-v4-pro for the command-code provider). Prefer the
- // rewritten value if present; fall back to the resolved combo model arg.
- // Normalize to the vendor-prefixed wire id the upstream requires (#10809).
const resolvedModel = normalizeCommandCodeWireModel(
- typeof input.model === "string" && input.model.trim().length > 0 ? input.model : model
+ typeof input.model === "string" && input.model.trim().length > 0
+ ? input.model
+ : model
);
- const converted = convertMessages(input.messages, resolvedModel, toolNameMap);
- const explicitSystem = typeof input.system === "string" ? input.system : "";
- const system = [converted.system, explicitSystem].filter(Boolean).join("\n\n");
-
- const params: JsonRecord = {
+ const out: JsonRecord = {
+ ...input,
model: resolvedModel,
- messages: converted.messages,
- tools: convertTools(input.tools, toolNameMap),
- system,
- stream: true,
+ stream: stream === true,
};
- // Only forward max_tokens when the client actually supplied one. Omitting it
- // lets Command Code's upstream apply the model's own native default, so we
- // never invent a value (the old behavior, which sent the wrong number and got
- // DeepSeek V4 rejected with "Too big: expected number to be <=200000"). When
- // present, it is clamped to the endpoint ceiling so an oversized client value
- // degrades gracefully instead of 400ing.
+ // Forward max_tokens only when the client actually supplied a positive value
+ // (clamped to the endpoint ceiling). Omitting it lets the provider's upstream
+ // apply the model's own native default; a non-positive value such as -1
+ // ("let the server choose") must be omitted, NOT coerced to 1 (#5166).
const maxTokens = clampMaxTokens(input.max_tokens ?? input.max_completion_tokens);
+ delete out.max_tokens;
+ delete out.max_completion_tokens;
if (maxTokens !== undefined) {
- params.max_tokens = maxTokens;
- }
-
- for (const field of COMMAND_CODE_PASSTHROUGH_FIELDS) {
- const value = input[field];
- if (value !== undefined && value !== null) {
- params[field] = value;
- }
- }
-
- return {
- body: {
- config: {
- workingDir: "/workspace",
- date: new Date().toISOString().slice(0, 10),
- environment: "external",
- structure: [],
- isGitRepo: false,
- currentBranch: "",
- mainBranch: "",
- gitStatus: "",
- recentCommits: [],
- },
- memory: "",
- taste: "",
- skills: "",
- permissionMode: "standard",
- params,
- },
- toolNameMap,
- };
-}
-
-function parseStreamLine(line: string): unknown | undefined {
- let trimmed = line.trim();
- if (!trimmed || trimmed.startsWith(":") || trimmed.startsWith("event:")) return undefined;
- if (trimmed.startsWith("data:")) trimmed = trimmed.slice(5).trim();
- if (!trimmed || trimmed === "[DONE]") return undefined;
-
- try {
- return JSON.parse(trimmed);
- } catch (error) {
- console.warn(
- "[commandCode] stream line parse failed:",
- error instanceof Error ? error.message : String(error)
- );
- return undefined;
- }
-}
-
-function mapFinishReason(reason: unknown): "stop" | "length" | "tool_calls" {
- if (reason === "tool-calls" || reason === "tool_calls" || reason === "toolUse")
- return "tool_calls";
- if (
- reason === "length" ||
- reason === "max_tokens" ||
- reason === "max-tokens" ||
- reason === "max_output_tokens"
- ) {
- return "length";
- }
- return "stop";
-}
-
-function chatCompletionChunk(
- id: string,
- model: string,
- delta: JsonRecord,
- finishReason: unknown = null
-) {
- return {
- id,
- object: "chat.completion.chunk",
- created: Math.floor(Date.now() / 1000),
- model,
- choices: [{ index: 0, delta, finish_reason: finishReason }],
- };
-}
-
-function sse(data: unknown): Uint8Array {
- return encoder.encode(`data: ${JSON.stringify(data)}\n\n`);
-}
-
-type AggregateState = {
- content: string;
- reasoning: string;
- toolCalls: JsonRecord[];
- finishReason: "stop" | "length" | "tool_calls";
- usage: JsonRecord | null;
-};
-
-function firstRecord(record: JsonRecord, keys: readonly string[]): JsonRecord {
- for (const key of keys) {
- const value = record[key];
- if (isRecord(value)) return value;
- }
- return {};
-}
-
-function firstNumber(record: JsonRecord, keys: readonly string[]): number | undefined {
- for (const key of keys) {
- const value = numberValue(record[key]);
- if (value !== undefined) return value;
- }
- return undefined;
-}
-
-/** Keep earlier finish-step usage when the terminal finish event omits it. */
-function mergeCommandCodeUsage(previous: JsonRecord | null, next: unknown): JsonRecord | null {
- if (!isRecord(next)) return previous;
-
- const merged: JsonRecord = { ...(previous || {}), ...next };
- for (const key of [
- "inputTokenDetails",
- "input_token_details",
- "input_tokens_details",
- "prompt_tokens_details",
- "outputTokenDetails",
- "output_token_details",
- "output_tokens_details",
- "completion_tokens_details",
- "reasoningTokenDetails",
- "reasoning_token_details",
- ]) {
- const before = isRecord(previous?.[key]) ? previous[key] : {};
- const after = isRecord(next[key]) ? next[key] : {};
- if (Object.keys(before).length > 0 || Object.keys(after).length > 0) {
- merged[key] = { ...before, ...after };
- }
- }
- return merged;
-}
-
-function rememberCommandCodeUsage(state: AggregateState, event: JsonRecord): void {
- const usage =
- event.type === "finish-step"
- ? (event.usage ?? event.totalUsage)
- : (event.totalUsage ?? event.usage);
- state.usage = mergeCommandCodeUsage(state.usage, usage);
-}
-
-function applyEventToAggregate(
- event: JsonRecord,
- state: AggregateState,
- toolNameMap: Map
-): void {
- // Some Command Code protocol revisions attach usage to the terminal payload
- // without preserving the event type. Capture it before event-specific handling.
- rememberCommandCodeUsage(state, event);
-
- switch (event.type) {
- case "text-delta":
- state.content += stringValue(event.text) || "";
- break;
- case "reasoning-delta":
- state.reasoning += stringValue(event.text) || "";
- break;
- case "tool-call": {
- const args = recordOrEmpty(event.input ?? event.args ?? event.arguments);
- state.toolCalls.push({
- id: stringValue(event.toolCallId) || stringValue(event.id) || randomUUID(),
- type: "function",
- function: {
- name: clientToolName(
- stringValue(event.toolName) || stringValue(event.name) || "",
- toolNameMap
- ),
- arguments: JSON.stringify(args),
- },
- });
- break;
- }
- case "finish-step":
- break;
- case "finish":
- state.finishReason = mapFinishReason(event.finishReason);
- break;
- }
-}
-
-function applyEventToAggregateOrThrow(
- event: JsonRecord,
- state: AggregateState,
- toolNameMap: Map
-): void {
- if (event.type === "error") {
- const error = isRecord(event.error) ? event.error : {};
- throw new Error(
- stringValue(error.message) || stringValue(event.error) || "Command Code stream error"
- );
+ out.max_tokens = maxTokens;
}
- applyEventToAggregate(event, state, toolNameMap);
-}
-
-function usageFromCommandCode(usage: JsonRecord | null) {
- if (!usage) return undefined;
- const inputDetails = firstRecord(usage, [
- "inputTokenDetails",
- "input_token_details",
- "input_tokens_details",
- "prompt_tokens_details",
- ]);
- const outputDetails = firstRecord(usage, [
- "outputTokenDetails",
- "output_token_details",
- "output_tokens_details",
- "completion_tokens_details",
- ]);
- const reasoningDetails = firstRecord(usage, [
- "reasoningTokenDetails",
- "reasoning_token_details",
- "reasoning_tokens_details",
- ]);
- const cacheRead =
- firstNumber(usage, [
- "cachedInputTokens",
- "cached_input_tokens",
- "cacheReadInputTokens",
- "cache_read_input_tokens",
- "cacheReadTokens",
- "cache_read_tokens",
- "cached_tokens",
- ]) ??
- firstNumber(inputDetails, [
- "cachedTokens",
- "cached_tokens",
- "cacheReadTokens",
- "cache_read_tokens",
- ]);
- const noCache = firstNumber(inputDetails, ["noCacheTokens", "no_cache_tokens"]);
- // Command Code's totalUsage.inputTokens is the FULL prompt total and already
- // includes the cached portion (noCacheTokens + cacheReadTokens = inputTokens),
- // so we must NOT add cacheRead back — that would double-count. There is no
- // cache-write field in the upstream payload, so cache creation stays unset.
- const prompt =
- firstNumber(usage, ["inputTokens", "input_tokens", "promptTokens", "prompt_tokens"]) ??
- (noCache ?? 0) + (cacheRead ?? 0);
- const reasoning =
- firstNumber(usage, ["reasoningTokens", "reasoning_tokens"]) ??
- firstNumber(outputDetails, ["reasoningTokens", "reasoning_tokens"]) ??
- firstNumber(reasoningDetails, ["reasoningTokens", "reasoning_tokens"]);
- const textOutput = firstNumber(outputDetails, ["textTokens", "text_tokens"]);
- const completion =
- firstNumber(usage, [
- "outputTokens",
- "output_tokens",
- "completionTokens",
- "completion_tokens",
- ]) ?? (textOutput ?? 0) + (reasoning ?? 0);
- const total = firstNumber(usage, ["totalTokens", "total_tokens"]) ?? prompt + completion;
- const result: JsonRecord = {
- prompt_tokens: prompt,
- prompt_tokens_details: { cached_tokens: cacheRead ?? 0 },
- completion_tokens: completion,
- completion_tokens_details: { reasoning_tokens: reasoning ?? 0 },
- total_tokens: total,
- };
- // Surface the cache breakdown as informational fields so logUsage prints
- // `| cache_read=X | no_cache=Y` and appendRequestLog persists them. These are
- // NOT added to prompt_tokens (already included) — metering stays accurate.
- if (cacheRead !== undefined && cacheRead > 0) result.cache_read_input_tokens = cacheRead;
- if (noCache !== undefined && noCache > 0) result.no_cache_tokens = noCache;
- if (reasoning !== undefined && reasoning > 0) result.reasoning_tokens = reasoning;
- return result;
-}
-
-function createStreamResponse(
- upstream: Response,
- model: string,
- signal?: AbortSignal | null,
- toolNameMap: Map = new Map()
-): Response {
- const id = `chatcmpl-${randomUUID()}`;
- const reader = upstream.body?.getReader();
- const decoder = new TextDecoder();
- let buffer = "";
- let sentRole = false;
- let closed = false;
- const state: AggregateState = {
- content: "",
- reasoning: "",
- toolCalls: [],
- finishReason: "stop",
- usage: null,
- };
-
- const stream = new ReadableStream({
- start(controller) {
- if (!reader) {
- controller.error(new Error("Command Code response missing body"));
- return;
- }
-
- const abort = () => {
- closed = true;
- reader.cancel().catch(() => undefined);
- controller.error(new DOMException("The operation was aborted", "AbortError"));
- };
- signal?.addEventListener("abort", abort, { once: true });
-
- const emitEvent = (event: unknown) => {
- if (!isRecord(event) || closed) return;
- rememberCommandCodeUsage(state, event);
- if (!sentRole) {
- sentRole = true;
- controller.enqueue(sse(chatCompletionChunk(id, model, { role: "assistant" })));
- }
-
- switch (event.type) {
- case "text-delta": {
- const text = stringValue(event.text) || "";
- if (text) controller.enqueue(sse(chatCompletionChunk(id, model, { content: text })));
- state.content += text;
- break;
- }
- case "reasoning-delta": {
- const text = stringValue(event.text) || "";
- if (text) {
- controller.enqueue(sse(chatCompletionChunk(id, model, { reasoning_content: text })));
- state.reasoning += text;
- }
- break;
- }
- case "tool-call": {
- const index = state.toolCalls.length;
- const args = recordOrEmpty(event.input ?? event.args ?? event.arguments);
- const toolCall = {
- id: stringValue(event.toolCallId) || stringValue(event.id) || randomUUID(),
- type: "function",
- function: {
- name: clientToolName(
- stringValue(event.toolName) || stringValue(event.name) || "",
- toolNameMap
- ),
- arguments: JSON.stringify(args),
- },
- };
- state.toolCalls.push(toolCall);
- controller.enqueue(
- sse(chatCompletionChunk(id, model, { tool_calls: [{ index, ...toolCall }] }))
- );
- break;
- }
- case "reasoning-end":
- break;
- case "finish-step":
- break;
- case "finish": {
- state.finishReason = mapFinishReason(event.finishReason);
- controller.enqueue(sse(chatCompletionChunk(id, model, {}, state.finishReason)));
- // Emit a standards-compliant usage-only chunk (choices: []) before
- // [DONE] when upstream reported usage. stream.ts's extractUsage
- // recognizes this shape (see stream.ts:1661) and logs the ACTUAL
- // token counts (in/out/cache_read/no_cache) instead of estimates.
- const usagePayload = usageFromCommandCode(state.usage);
- if (usagePayload) {
- controller.enqueue(
- sse({
- id,
- object: "chat.completion.chunk",
- model,
- usage: usagePayload,
- choices: [],
- })
- );
- }
- controller.enqueue(encoder.encode("data: [DONE]\n\n"));
- closed = true;
- controller.close();
- reader.cancel().catch(() => undefined);
- break;
- }
- case "error": {
- const error = isRecord(event.error) ? event.error : {};
- throw new Error(
- stringValue(error.message) || stringValue(event.error) || "Command Code stream error"
- );
- }
- }
- };
-
- const pump = async () => {
- try {
- for (;;) {
- if (closed) return;
- const { done, value } = await reader.read();
- if (done) break;
- buffer += decoder.decode(value, { stream: true });
- const lines = buffer.split("\n");
- buffer = lines.pop() || "";
- for (const line of lines) emitEvent(parseStreamLine(line));
- }
- if (buffer.trim()) emitEvent(parseStreamLine(buffer));
- if (!closed) {
- if (!sentRole)
- controller.enqueue(sse(chatCompletionChunk(id, model, { role: "assistant" })));
- controller.enqueue(sse(chatCompletionChunk(id, model, {}, state.finishReason)));
- controller.enqueue(encoder.encode("data: [DONE]\n\n"));
- controller.close();
- }
- } catch (error) {
- controller.error(error);
- } finally {
- signal?.removeEventListener("abort", abort);
- try {
- reader.releaseLock();
- } catch (error) {
- console.warn(
- "[commandCode] reader releaseLock failed:",
- error instanceof Error ? error.message : String(error)
- );
- }
- }
- };
-
- pump();
- },
- cancel() {
- closed = true;
- return reader?.cancel();
- },
- });
-
- return new Response(stream, {
- status: 200,
- headers: { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache" },
- });
-}
-
-async function createJsonResponse(
- upstream: Response,
- model: string,
- signal?: AbortSignal | null,
- toolNameMap: Map = new Map()
-): Promise {
- const reader = upstream.body?.getReader();
- if (!reader) throw new Error("Command Code response missing body");
-
- const decoder = new TextDecoder();
- let buffer = "";
- const state: AggregateState = {
- content: "",
- reasoning: "",
- toolCalls: [],
- finishReason: "stop",
- usage: null,
- };
-
- try {
- for (;;) {
- if (signal?.aborted) throw new DOMException("The operation was aborted", "AbortError");
- const { done, value } = await reader.read();
- if (done) break;
- buffer += decoder.decode(value, { stream: true });
- const lines = buffer.split("\n");
- buffer = lines.pop() || "";
- for (const line of lines) {
- const event = parseStreamLine(line);
- if (!isRecord(event)) continue;
- applyEventToAggregateOrThrow(event, state, toolNameMap);
- }
- }
- if (buffer.trim()) {
- const event = parseStreamLine(buffer);
- if (isRecord(event)) applyEventToAggregateOrThrow(event, state, toolNameMap);
- }
- } finally {
- try {
- await reader.cancel();
- } catch (error) {
- console.warn(
- "[commandCode] reader cancel failed:",
- error instanceof Error ? error.message : String(error)
- );
- }
- try {
- reader.releaseLock();
- } catch (error) {
- console.warn(
- "[commandCode] reader releaseLock failed:",
- error instanceof Error ? error.message : String(error)
- );
- }
- }
-
- const message: JsonRecord = { role: "assistant", content: state.content };
- if (state.reasoning) message.reasoning_content = state.reasoning;
- if (state.toolCalls.length > 0) message.tool_calls = state.toolCalls;
-
- const payload: JsonRecord = {
- id: `chatcmpl-${randomUUID()}`,
- object: "chat.completion",
- created: Math.floor(Date.now() / 1000),
- model,
- choices: [{ index: 0, message, finish_reason: state.finishReason }],
- };
- const usage = usageFromCommandCode(state.usage);
- if (usage) payload.usage = usage;
-
- return new Response(JSON.stringify(payload), {
- status: 200,
- headers: { "Content-Type": "application/json" },
- });
+ return { body: out };
}
export class CommandCodeExecutor extends BaseExecutor {
@@ -973,7 +118,7 @@ export class CommandCodeExecutor extends BaseExecutor {
buildUrl() {
const baseUrl = (this.config.baseUrl || "https://api.commandcode.ai").replace(/\/$/, "");
- return `${baseUrl}${this.config.chatPath || "/alpha/generate"}`;
+ return `${baseUrl}${this.config.chatPath || "/provider/v1/chat/completions"}`;
}
async execute({ model, body, stream, credentials, signal, upstreamExtraHeaders }: ExecuteInput) {
@@ -983,26 +128,17 @@ export class CommandCodeExecutor extends BaseExecutor {
const headers: Record = {
"Content-Type": "application/json",
Authorization: `Bearer ${apiKey}`,
- "x-command-code-version": COMMAND_CODE_VERSION,
- "x-cli-environment": "external",
- "x-project-slug": "pi-cc",
- "x-taste-learning": "false",
- "x-co-flag": "false",
- "x-session-id": randomUUID(),
+ Accept: stream ? "text/event-stream" : "application/json",
};
mergeUpstreamExtraHeaders(headers, upstreamExtraHeaders);
// The combo/single-model dispatch boundary does not always run
// sanitizeRequestForResolvedTarget before reaching this executor (combo
// path), and Command Code rejects unsupported reasoning_effort values
- // outright (e.g. "minimal" → 400 "expected one of low|medium|high|xhigh|max").
- // Sanitize here — the executor is the last line of defense for the wire body.
+ // outright. Sanitize here — the executor is the last line of defense for
+ // the wire body.
const sanitizedBody = sanitizeReasoningEffortForProvider(body, this.provider, model);
- const { body: transformedBody, toolNameMap } = buildCommandCodeBody(
- model,
- sanitizedBody,
- stream
- );
+ const { body: transformedBody } = buildOpenAiBody(model, sanitizedBody, stream);
const url = this.buildUrl();
const upstream = await fetch(url, {
method: "POST",
@@ -1028,10 +164,9 @@ export class CommandCodeExecutor extends BaseExecutor {
};
}
- const response = stream
- ? createStreamResponse(upstream, model, signal, toolNameMap)
- : await createJsonResponse(upstream, model, signal, toolNameMap);
-
- return { response, url, headers, transformedBody };
+ // The /provider/v1/chat/completions endpoint returns standard OpenAI-format
+ // SSE (stream) or JSON (non-stream) straight through, so the upstream
+ // Response passes through untouched — no AI-SDK/CLI event re-parsing needed.
+ return { response: upstream, url, headers, transformedBody };
}
-}
+}
\ No newline at end of file
diff --git a/open-sse/executors/copilot-m365-frames.ts b/open-sse/executors/copilot-m365-frames.ts
index 7260afebd7aa..f4172b11904e 100644
--- a/open-sse/executors/copilot-m365-frames.ts
+++ b/open-sse/executors/copilot-m365-frames.ts
@@ -30,17 +30,45 @@ export const HANDSHAKE_REQUEST = { protocol: "json", version: 1 } as const;
export const KEEPALIVE_PING = { type: 6 } as const;
/**
- * Allowed message types observed in the 2026-08 recapture of the working
- * `m365.cloud.microsoft/chat` client (#10718). The old 11-entry list is no longer
- * seen on the wire — the stale shape gets closed immediately after the type:4.
+ * Allowed message types observed in a 2026-08-21 live capture of a working
+ * `m365.cloud.microsoft/chat` session (issue: "Stream ended before producing a
+ * non-ping SSE event" on every individual/consumer M365 Copilot call). The
+ * #10718 6-entry shape above no longer produces a `type:1 target:"update"`
+ * frame at all — the socket only replies with SignalR keepalive pings and then
+ * closes, which is exactly what surfaces client-side as that generic stream
+ * error. 30 entries, up from 6.
*/
export const ALLOWED_MESSAGE_TYPES = [
"Chat",
"Suggestion",
+ "InternalSearchQuery",
"Disengaged",
+ "InternalLoaderMessage",
"Progress",
+ "GeneratedCode",
+ "RenderCardRequest",
+ "AdsQuery",
+ "SemanticSerp",
+ "GenerateContentQuery",
+ "GenerateGraphicArt",
+ "SearchQuery",
+ "ConfirmationCard",
+ "AuthError",
+ "DeveloperLogs",
+ "TriggerPlugin",
+ "HintInvocation",
+ "MemoryUpdate",
"EndOfRequest",
- "InternalLoaderMessage",
+ "TriggerConfirmation",
+ "ResumeInvokeAction",
+ "ResumeUserInputRequest",
+ "TriggerUserInputRequest",
+ "EscapeHatch",
+ "TriggerPluginAuth",
+ "ResumePluginAuth",
+ "SideBySide",
+ "ReferencesListComplete",
+ "SwitchRespondingEndpoint",
] as const;
/**
@@ -78,19 +106,26 @@ export const M365_ENTERPRISE_EXTRA_MESSAGE_TYPES = [
] as const;
/**
- * Individual / EDU option sets from the 2026-08 recapture (#10718) — 14 entries.
- * The previous 25-entry consumer/MSA set (enable_msa_user, pdnascan, cwc_code_*,
- * …) is no longer observed on the wire and belongs to the shape the substrate
- * now drops silently.
+ * Individual / EDU option sets from a 2026-08-21 live capture — 34 entries, up
+ * from the #10718 14-entry shape (which itself superseded an earlier 25-entry
+ * shape). Each recapture so far has been additive/reshuffled rather than a
+ * wholesale replacement — treat this as the protocol continuing to drift, not
+ * a one-time fix; a future capture may again need to update this list.
*/
export const M365_DEFAULT_OPTION_SETS = [
"search_result_progress_messages_with_search_queries",
"update_textdoc_response_after_streaming",
"deepleo_networking_timeout_10minutes_canmore",
"cwc_flux_image",
+ "cwc_code_interpreter",
+ "cwc_code_interpreter_amsfix",
"cwcfluxgptv",
"flux_v3_gptv_enable_upload_multi_image_in_turn_wo_ch",
"gptvnorm2048",
+ "cwc_code_interpreter_citation_fix",
+ "code_interpreter_interactive_charts",
+ "cwc_code_interpreter_interactive_charts_inline_image",
+ "code_interpreter_matplotlib_patching",
"cwc_fileupload_odb",
"update_memory_plugin",
"add_custom_instructions",
@@ -98,6 +133,20 @@ export const M365_DEFAULT_OPTION_SETS = [
"flux_v3_progress_messages",
"enable_batch_token_processing",
"enable_gg_gpt",
+ "async_client_interaction",
+ "flux_v3_references",
+ "flux_v3_references_entities",
+ "flux_v3_references_ci",
+ "add_filestore_filetype",
+ "cwc_code_interpreter_citation_sourceannotations",
+ "cdxcwc_code_interpreter_hallucinated_url_filter",
+ "flux_v3_image_gen_enable_dimensions",
+ "flux_v3_image_gen_enable_non_watermarked_storage",
+ "flux_v3_image_gen_enable_icon_dimensions",
+ "flux_v3_image_gen_enable_system_text_with_params",
+ "flux_v3_image_gen_enable_designer_dimensions_meta_prompting_in_system_prompts",
+ "flux_v3_image_gen_enable_story",
+ "rich_responses",
] as const;
/** Append the record separator to a JSON-serializable frame. */
@@ -433,12 +482,14 @@ export function resolveChatInvocationOverrides(tier: string | undefined): {
}
return {
optionsSets: [...M365_DEFAULT_OPTION_SETS],
- // #10718 — the 2026-08 recapture sends tone:"magic" (lowercase) on the
- // individual/EDU surface; the old "" default is part of the dropped shape.
- tone: "magic",
+ // 2026-08-21 capture — the individual/consumer surface now sends "Magic"
+ // (capitalized), matching the enterprise tone literal. The #10718
+ // lowercase "magic" is part of the shape that gets silently dropped.
+ tone: "Magic",
allowedMessageTypes: ALLOWED_MESSAGE_TYPES,
- // Omitted entirely on the individual/EDU wire (see ChatInvocationOptions).
- disconnectBehavior: undefined,
+ // 2026-08-21 capture — disconnectBehavior:"continue" is now present on the
+ // individual/consumer wire too, not just enterprise (see ChatInvocationOptions).
+ disconnectBehavior: "continue",
};
}
@@ -467,16 +518,33 @@ export function resolveToneForModel(model: string | undefined): string | undefin
/**
* Build the `type:4` chat invocation frame body (not yet `\x1e`-terminated).
- * Mirrors the argument shape recaptured from a working `m365.cloud.microsoft/chat`
- * client in 2026-08 (#10718). Notable differences from the pre-#10718 shape: a
- * populated `clientInfo` + `productThreadType:"Office"`, a `conversationId`
- * matching the WS URL query, a rich `message` object, and no
- * `spokenTextMode` / `extraExtensionParameters` / `isSbsSupported` /
- * `renderReferencesBehindEOS` / `disconnectBehavior` — none of those are still
- * observed on the wire, and the stale shape gets closed immediately after the
- * invocation.
+ * Base shape from the #10718 recapture (populated `clientInfo` +
+ * `productThreadType:"Office"`, a `conversationId` matching the WS URL query, a
+ * rich `message` object), extended per a 2026-08-21 live capture that found the
+ * #10718 shape alone no longer produces a `type:1 target:"update"` frame — the
+ * socket only replies with keepalive pings and closes. The additions below
+ * (richer `clientInfo`, non-empty `plugins`, `extraExtensionParameters`,
+ * `isSbsSupported`, `renderReferencesBehindEOS`,
+ * `message.connectedFederatedConnections`, and `disconnectBehavior` on every
+ * tier) are exactly the fields the 2026-08-21 capture had that this shape was
+ * missing; the #10718 fields (`conversationId`, `productThreadType`,
+ * `toolChoice`, `message.attachments`) are kept as-is since removing them was
+ * not verified against a live socket.
*/
export function buildChatInvocation(opts: ChatInvocationOptions): Record {
+ const clientInfo = {
+ clientAppName: "Office",
+ clientPlatform: "mcmcopilot-web",
+ clientEntrypoint: "mcmcopilot-officeweb",
+ clientSessionId: opts.sessionId,
+ ProductCategory: "Chat",
+ clientAppType: "Web",
+ productEntryPoint: "ChatPanel",
+ deviceOS: "Windows",
+ deviceType: "Desktop",
+ clientPlatformVersion: "10",
+ };
+
return {
type: 4,
target: "chat",
@@ -487,17 +555,17 @@ export function buildChatInvocation(opts: ChatInvocationOptions): Record
+ * Endpoint: POST https://chat.minimax.io/v4/api/chat/msg?
* Auth: `token` header — value read from the site's `_token` localStorage
* entry, plus a per-request `yy` signature header.
* Body: multipart/form-data — characterID, msgContent, chatID, searchMode.
@@ -33,7 +33,7 @@ import { createHash } from "node:crypto";
import { BaseExecutor, type ExecuteInput } from "./base.ts";
import { makeExecutorErrorResult as makeErrorResult, sanitizeErrorMessage } from "../utils/error.ts";
-const BASE_URL = "https://www.hailuo.ai";
+const BASE_URL = "https://chat.minimax.io";
const API_PATH = "/v4/api/chat/msg";
const USER_AGENT =
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36";
diff --git a/open-sse/executors/kimi-web.ts b/open-sse/executors/kimi-web.ts
index 8f9c13c33282..f2c389822c31 100644
--- a/open-sse/executors/kimi-web.ts
+++ b/open-sse/executors/kimi-web.ts
@@ -1,10 +1,10 @@
/**
- * KimiWebExecutor — Moonshot AI Chat via www.kimi.com (international)
+ * KimiWebExecutor — Moonshot AI Chat via www.kimi.ai (international)
*
* Routes requests through Kimi's consumer chat API on the international domain.
* Originally this executor targeted `kimi.moonshot.cn` (mainland-CN consumer
* chat). That domain now redirects every visitor outside CN to
- * `https://www.kimi.com/`, which speaks a completely different API surface:
+ * `https://www.kimi.ai/`, which speaks a completely different API surface:
*
* - Endpoint: POST /apiv2/kimi.gateway.chat.v1.ChatService/Chat
* - Protocol: Connect-RPC (unary envelope framing — 5-byte header + JSON)
@@ -326,7 +326,7 @@ export class KimiWebExecutor extends BaseExecutor {
if (!accessToken) {
return makeErrorResult(
400,
- "Missing Kimi access_token — log in at www.kimi.com and capture access_token from localStorage.",
+ "Missing Kimi access_token — log in at www.kimi.ai and capture access_token from localStorage.",
body,
CHAT_URL
);
@@ -410,10 +410,7 @@ export class KimiWebExecutor extends BaseExecutor {
const refreshToken =
credentials?.refreshToken || credentials?.providerSpecificData?.refreshToken;
if (refreshToken && typeof refreshToken === "string") {
- const refreshRes = await exchangeKimiRefreshToken(
- refreshToken,
- getKimiWebBaseUrl()
- );
+ const refreshRes = await exchangeKimiRefreshToken(refreshToken, getKimiWebBaseUrl());
if (refreshRes.success && refreshRes.accessToken) {
accessToken = refreshRes.accessToken;
const retryHeaders = this.buildKimiHeaders(accessToken);
diff --git a/open-sse/executors/nlpcloud.ts b/open-sse/executors/nlpcloud.ts
index d413b5a683b7..e212a38efeb7 100644
--- a/open-sse/executors/nlpcloud.ts
+++ b/open-sse/executors/nlpcloud.ts
@@ -471,6 +471,7 @@ export class NlpCloudExecutor extends BaseExecutor {
}
try {
+ this.assertOutboundUrlAllowed(url); // GHSA-4f49: nlpcloud has its own fetch path
const response = await fetch(url, {
method: "POST",
headers,
diff --git a/open-sse/executors/opencode.ts b/open-sse/executors/opencode.ts
index b5f5ad7880f7..0829bfa871d3 100644
--- a/open-sse/executors/opencode.ts
+++ b/open-sse/executors/opencode.ts
@@ -1,6 +1,6 @@
import { BaseExecutor, type ExecuteInput, type ProviderCredentials } from "./base.ts";
import { PROVIDERS } from "../config/constants.ts";
-import { getModelTargetFormat } from "../config/providerModels.ts";
+import { getModelTargetFormat, PROVIDER_ID_TO_ALIAS } from "../config/providerModels.ts";
import {
injectReasoningContentForThinkingModel,
isThinkingMessageModel,
@@ -15,6 +15,8 @@ import {
markSuccess as markAccountSuccess,
maskAccountId,
isNetworkErrorRotatable,
+ isEmptyUpstreamRejection,
+ extractChatcmplId,
} from "./accountRotation.ts";
import { isNetworkRotationSharedEgressGuardEnabled } from "@/shared/utils/featureFlags";
@@ -125,6 +127,24 @@ export function isPremiumOpencodeModel(model: string, provider: string): boolean
return !OPENCODE_FREE_MODELS.has(model);
}
+/**
+ * Resolves the registry `targetFormat` for a model, aliasing `provider` first.
+ *
+ * `PROVIDER_MODELS` is keyed by the provider's public ALIAS (e.g. `"oc"`), not its
+ * raw registry id (e.g. `"opencode"`) — mirrors `resolveChatCoreTargetFormat()`
+ * (`handlers/chatCore/targetFormat.ts`), which already aliases before calling
+ * `getModelTargetFormat()`. Calling it with the raw id here made every entry miss
+ * silently (fell through to `"openai"`), while chatCore's own request-body
+ * translation (correctly aliased) still switched to the Responses API shape for
+ * `targetFormat:"openai-responses"` models — sending a Responses-shaped body to
+ * the `/chat/completions` URL this executor's own `buildUrl()` kept selecting.
+ * Exported for testability.
+ */
+export function resolveOpencodeTargetFormat(provider: string, model: string): string {
+ const alias = PROVIDER_ID_TO_ALIAS[provider] || provider;
+ return getModelTargetFormat(alias, model) || "openai";
+}
+
export class OpencodeExecutor extends BaseExecutor {
/** Delegates to `isPremiumOpencodeModel`. Exported for testability. */
static isPremiumModel(model: string, provider: string): boolean {
@@ -193,7 +213,10 @@ export class OpencodeExecutor extends BaseExecutor {
return pickRotatableAccount(this.accounts, this);
}
- private markCooldown(account: OpencodeAccountState, kind: "transient" | "terminal" = "transient"): void {
+ private markCooldown(
+ account: OpencodeAccountState,
+ kind: "transient" | "terminal" = "transient"
+ ): void {
markAccountCooldown(account, kind);
}
@@ -202,7 +225,7 @@ export class OpencodeExecutor extends BaseExecutor {
}
async execute(input: ExecuteInput) {
- this._requestFormat = getModelTargetFormat(this.provider, input.model) || "openai";
+ this._requestFormat = resolveOpencodeTargetFormat(this.provider, input.model);
// #8681: Gate premium opencode models behind a usable API key.
// When the connection is keyless (no apiKey, no accessToken) and the model
@@ -232,14 +255,41 @@ export class OpencodeExecutor extends BaseExecutor {
try {
this.syncAccountsFromCredentials(input.credentials);
+ const { log } = input;
const hasProxies = this.accounts.some((a) => a.proxy !== null);
- // Fast path: no multi-account proxy wiring configured → original behavior.
+ // Fast path: no multi-account proxy wiring configured → original behavior,
+ // plus exactly ONE bounded retry when the upstream answers a 400 empty
+ // rejection (same predicate and logging as the rotation loop). Everything
+ // else passes untouched: this path deliberately preserves BaseExecutor's
+ // intra-URL 429 retries (no skipUpstreamRetry here).
if (this.accounts.length === 1 && !hasProxies) {
- return await super.execute(input);
+ const single = (await super.execute(input)) as HttpExecuteResult;
+ if (single.response.status === 400) {
+ let bodyText: string | null = null;
+ try {
+ bodyText = await single.response.clone().text();
+ } catch {
+ log?.debug?.("OPENCODE", "body read failed on direct account");
+ }
+ if (bodyText !== null) {
+ if (isEmptyUpstreamRejection(400, bodyText)) {
+ const chatcmplId = extractChatcmplId(bodyText);
+ log?.warn?.(
+ "OPENCODE",
+ `upstream empty rejection on direct account (${chatcmplId}), retrying once…`
+ );
+ return await super.execute(input);
+ }
+ log?.debug?.(
+ "OPENCODE",
+ "400 without error field, signature not matched on direct account — observing"
+ );
+ }
+ }
+ return single;
}
- const { log } = input;
// This loop only ever dispatches through super.execute() (the HTTP request
// path), which always resolves the object-shaped arm of ExecutorExecuteResult
// — the bare-Response arm belongs to web/scraping executors only (base.ts:290).
@@ -256,8 +306,13 @@ export class OpencodeExecutor extends BaseExecutor {
// network call, but proxied accounts (independent egress) are still
// tried normally.
let sharedEgressDown = false;
+ // Bounded extra attempts for empty upstream rejections: +1 for a single
+ // account (retry the same one), none for a multi-account fleet (rotation
+ // through the accounts is the retry). Avoids an unbounded loop on a
+ // persistently malformed upstream.
+ const emptyRejectionBudget = this.accounts.length === 1 ? 1 : 0;
- for (let attempt = 0; attempt < this.accounts.length; attempt++) {
+ for (let attempt = 0; attempt < this.accounts.length + emptyRejectionBudget; attempt++) {
const account = this.pickAccount();
const masked = maskAccountId(account.fingerprint);
@@ -333,6 +388,34 @@ export class OpencodeExecutor extends BaseExecutor {
continue;
}
+ // Empty upstream rejection (malformed 400: no error field, no real
+ // content, finish_reason null — see isEmptyUpstreamRejection). Rotate/
+ // retry instead of propagating it as a fatal success: the observed
+ // envelope was marking subagent sessions as failed. Read the body ONLY
+ // for a 400 (never a 200/streaming — that would buffer the good path);
+ // classify, log, and continue. Neitheries markCooldown nor markSuccess:
+ // the failure is upstream's, not this account's.
+ if (status === 400) {
+ let bodyText: string | null = null;
+ try {
+ bodyText = await result.response.clone().text();
+ } catch {
+ log?.debug?.("OPENCODE", "body read failed on empty rejection check");
+ }
+ if (bodyText !== null && isEmptyUpstreamRejection(400, bodyText)) {
+ const chatcmplId = extractChatcmplId(bodyText);
+ log?.warn?.(
+ "OPENCODE",
+ `upstream empty rejection on account ${masked} (${chatcmplId}), rotating to next…`
+ );
+ continue;
+ }
+ // A 400 carrying a real error (or non-empty content): propagate
+ // immediately, untouched — same as before this change.
+ this.markSuccess(account);
+ return result;
+ }
+
this.markSuccess(account);
return result;
}
diff --git a/open-sse/executors/zcode.ts b/open-sse/executors/zcode.ts
index 0841b4daa8e3..8f0a98ac1420 100644
--- a/open-sse/executors/zcode.ts
+++ b/open-sse/executors/zcode.ts
@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
import { existsSync } from "node:fs";
import { homedir } from "node:os";
import { join, resolve } from "node:path";
-import { GLM_SHARED_MODELS } from "../config/glmProvider.ts";
+import { ZCODE_MODELS } from "../config/providers/registry/zcode/index.ts";
import { BaseExecutor, type ExecuteInput, type ExecutorExecuteResult, type ProviderCredentials } from "./base.ts";
import { ZcodeAppServerClient, type ZcodeClientLike } from "./zcodeProtocol.ts";
import { buildErrorBody, errorResponse, sanitizeErrorMessage } from "../utils/error.ts";
@@ -12,8 +12,8 @@ const DEFAULT_PROVIDER_ID = "builtin:zai-coding-plan";
const DEFAULT_TURN_TIMEOUT_MS = 120_000;
const DEFAULT_POLL_INTERVAL_MS = 250;
const TERMINAL_STATUSES = new Set(["completed", "idle", "paused", "error"]);
-const ZCODE_MODEL_ALLOWLIST = new Set(GLM_SHARED_MODELS.map((model) => model.id));
-const DEFAULT_ZCODE_MODEL = GLM_SHARED_MODELS[0]?.id || "glm-5.2";
+const ZCODE_MODEL_ALLOWLIST = new Set(ZCODE_MODELS.map((model) => model.id));
+const DEFAULT_ZCODE_MODEL = ZCODE_MODELS[0]?.id || "glm-5.2";
type JsonRecord = Record;
type OpenAIMsg = { role?: string; content?: unknown };
diff --git a/open-sse/handlers/chatCore.ts b/open-sse/handlers/chatCore.ts
index 8f11373b1fbf..fea8640f9d3c 100644
--- a/open-sse/handlers/chatCore.ts
+++ b/open-sse/handlers/chatCore.ts
@@ -516,7 +516,7 @@ export async function handleChatCore({
conversationId = null,
modelPinned = false,
skipResourcePressureGuard = false,
- reasoningTransportFallback = "skip",
+ reasoningTransportFallback = "drop",
managedLease = null,
}) {
let { provider, model, extendedContext } = modelInfo;
@@ -1213,7 +1213,7 @@ export async function handleChatCore({
provider,
preserveEncryptedReasoning:
credentials?.providerSpecificData?.preserveEncryptedReasoning === true,
- onIncompatibleReasoning: reasoningTransportFallback === "drop" ? "drop" : "reject",
+ onIncompatibleReasoning: reasoningTransportFallback === "skip" ? "reject" : "drop",
}
);
if (policy.incompatibleReasoning) {
diff --git a/open-sse/handlers/rerank.ts b/open-sse/handlers/rerank.ts
index 747e1ce50662..452e6f3500e0 100644
--- a/open-sse/handlers/rerank.ts
+++ b/open-sse/handlers/rerank.ts
@@ -199,6 +199,8 @@ export async function handleRerank({
return_documents,
credentials,
connectionId = null,
+ apiKeyId = null,
+ apiKeyName = null,
}) {
const startTime = Date.now();
if (!model) return errorResponse(400, "model is required");
@@ -267,10 +269,23 @@ export async function handleRerank({
if (!res.ok) {
const errData = await res.json().catch(() => ({}));
- return errorResponse(
- res.status,
- errData.message || errData.error?.message || `Provider returned HTTP ${res.status}`
- );
+ const errorMessage =
+ errData.message || errData.error?.message || `Provider returned HTTP ${res.status}`;
+ saveCallLog({
+ method: "POST",
+ path: "/v1/rerank",
+ status: res.status,
+ model: `${providerId}/${modelId}`,
+ provider: providerId,
+ connectionId: connectionId || undefined,
+ duration: Date.now() - startTime,
+ requestBody,
+ responseBody: errData,
+ error: errorMessage,
+ apiKeyId: apiKeyId || undefined,
+ apiKeyName: apiKeyName || undefined,
+ }).catch(() => {});
+ return errorResponse(res.status, errorMessage);
}
const data = await res.json();
@@ -289,10 +304,13 @@ export async function handleRerank({
status: 200,
model: `${providerId}/${modelId}`,
provider: providerId,
+ connectionId: connectionId || undefined,
duration: Date.now() - startTime,
tokens: { prompt_tokens: 0, completion_tokens: 0 },
- responseBody: { results_count: Array.isArray(result?.results) ? result.results.length : 0 },
- connectionId,
+ requestBody,
+ responseBody: result,
+ apiKeyId: apiKeyId || undefined,
+ apiKeyName: apiKeyName || undefined,
}).catch(() => {});
const headers = new Headers({ ...CORS_HEADERS, "Content-Type": "application/json" });
diff --git a/open-sse/handlers/responseTranslator.ts b/open-sse/handlers/responseTranslator.ts
index 01bdd4c14a74..43e03d919d64 100644
--- a/open-sse/handlers/responseTranslator.ts
+++ b/open-sse/handlers/responseTranslator.ts
@@ -10,6 +10,7 @@ import {
caseInsensitiveToolNameLookup,
restoreOpenAIToolNames,
} from "../translator/helpers/toolCallHelper.ts";
+import { restoreClaudeToolName } from "../services/claudeCodeToolRemapper.ts";
import { extractReplayableResponsesReasoningText } from "../services/reasoningInputPolicy.ts";
import { sanitizeToolId } from "../translator/helpers/schemaCoercion.ts";
@@ -631,7 +632,7 @@ export function translateNonStreamingResponse(
// Phase 3: Translate from OpenAI back to Client Source format
if (sourceFormat === FORMATS.CLAUDE && sourceFormat !== targetFormat) {
- return convertOpenAINonStreamingToClaude(toRecord(intermediateOpenAI));
+ return convertOpenAINonStreamingToClaude(toRecord(intermediateOpenAI), toolNameMap ?? null);
}
// Gemini-family clients (Gemini, Antigravity): the streaming SSE path already
@@ -667,8 +668,18 @@ function resolveReasoningText(messageObj: JsonRecord): string {
/**
* Helper to convert an OpenAI chat.completion JSON object to Claude format for non-streaming.
+ *
+ * `toolNameMap` carries request-side aliases; when it does not resolve a name,
+ * `restoreClaudeToolName` upgrades known Claude Code tools to their canonical
+ * PascalCase ("bash" → "Bash", "croncreate" → "CronCreate"). Without this, a
+ * non-streaming upstream JSON body (or a stream:true request the upstream
+ * answered with application/json) reaches Claude Code with lowercase tool_use
+ * names the CLI rejects as "No such tool available".
*/
-function convertOpenAINonStreamingToClaude(openaiResponse: JsonRecord): JsonRecord {
+function convertOpenAINonStreamingToClaude(
+ openaiResponse: JsonRecord,
+ toolNameMap?: Map | null
+): JsonRecord {
const choices = openaiResponse.choices as unknown[] | undefined;
const isChoicesArray = Array.isArray(choices);
if (!isChoicesArray && openaiResponse.object !== "chat.completion") {
@@ -717,7 +728,7 @@ function convertOpenAINonStreamingToClaude(openaiResponse: JsonRecord): JsonReco
content.push({
type: "tool_use",
id: sanitizeToolId(rawId),
- name: toString(fn.name),
+ name: restoreClaudeToolName(toString(fn.name), toolNameMap ?? null),
input:
typeof fn.arguments === "string" ? JSON.parse(fn.arguments || "{}") : fn.arguments || {},
});
diff --git a/open-sse/mcp-server/__tests__/glmCodingProviderConfig.test.ts b/open-sse/mcp-server/__tests__/glmCodingProviderConfig.test.ts
index 8b7f3cee3240..50c16fa9665d 100644
--- a/open-sse/mcp-server/__tests__/glmCodingProviderConfig.test.ts
+++ b/open-sse/mcp-server/__tests__/glmCodingProviderConfig.test.ts
@@ -106,6 +106,29 @@ describe("GLM Coding provider registry surfaces", () => {
]);
});
+ it("declares exact GLM reasoning-effort tiers across every shared GLM provider", () => {
+ const routedTiers = new Map([
+ ["glm-5.3", ["low", "high", "max"]],
+ ["glm-5.3-high", ["high"]],
+ ["glm-5.3-low", ["low"]],
+ ["glm-5.2", ["high", "max"]],
+ ["glm-5.2-high", ["high"]],
+ ["glm-5.2-max", ["max"]],
+ ]);
+
+ for (const provider of ["glm", "glm-cn", "glmt"]) {
+ for (const model of getModelsByProviderId(provider)) {
+ expect(model.supportedThinkingEfforts, `${provider}/${model.id} effort tiers`).toEqual(
+ routedTiers.get(model.id) ?? []
+ );
+ }
+ }
+
+ for (const model of getModelsByProviderId("zcode")) {
+ expect(model.supportedThinkingEfforts, `zcode/${model.id} effort tiers`).toEqual([]);
+ }
+ });
+
it("registers GLM-5.2 with correct specs and effort tier aliases", () => {
const models = getModelsByProviderId("glm");
const get = (id: string) => models.find((m) => m.id === id);
diff --git a/open-sse/mcp-server/__tests__/mcp-runtime-blocked-provider-schema.test.ts b/open-sse/mcp-server/__tests__/mcp-runtime-blocked-provider-schema.test.ts
new file mode 100644
index 000000000000..9f55c6a52084
--- /dev/null
+++ b/open-sse/mcp-server/__tests__/mcp-runtime-blocked-provider-schema.test.ts
@@ -0,0 +1,58 @@
+import { describe, it, expect } from "vitest";
+import { createMcpServer } from "../server";
+import { buildWebSearchInputSchema } from "../schemas/tools";
+import { getActiveSearchProviders } from "../schemas/providerEnums";
+
+interface ToolWithSchema {
+ inputSchema: {
+ safeParse: (arg: unknown) => { success: boolean };
+ };
+}
+
+describe("MCP Dynamic Runtime Schema Plumbing", () => {
+ it("getActiveSearchProviders excludes blocked providers dynamically by id or alias", () => {
+ const allProviders = getActiveSearchProviders([]);
+ expect(allProviders).toContain("serper-search");
+ expect(allProviders).toContain("brave-search");
+
+ const filteredProviders = getActiveSearchProviders(["serper", "brave"]);
+ expect(filteredProviders).not.toContain("serper-search");
+ expect(filteredProviders).not.toContain("brave-search");
+ expect(filteredProviders.length).toBeGreaterThan(0);
+ });
+
+ it("buildWebSearchInputSchema excludes blocked providers from Zod enum", () => {
+ const fullSchema = buildWebSearchInputSchema([]);
+ const fullParsed = fullSchema.safeParse({ query: "test", provider: "serper-search" });
+ expect(fullParsed.success).toBe(true);
+
+ const blockedSchema = buildWebSearchInputSchema(["serper"]);
+ const blockedParsed = blockedSchema.safeParse({ query: "test", provider: "serper-search" });
+ expect(blockedParsed.success).toBe(false);
+ });
+
+ it("createMcpServer with blockedProviders option registers dynamic tool schema", async () => {
+ const server = createMcpServer({ blockedProviders: ["serper", "brave"] });
+ expect(server).toBeTruthy();
+
+ const registeredTools = (
+ server as unknown as { _registeredTools: Record }
+ )._registeredTools;
+ expect(registeredTools).toBeTruthy();
+
+ const webSearchTool = registeredTools["omniroute_web_search"];
+ expect(webSearchTool).toBeTruthy();
+
+ const parsedWithUnblocked = webSearchTool.inputSchema.safeParse({
+ query: "test",
+ provider: "perplexity-search",
+ });
+ expect(parsedWithUnblocked.success).toBe(true);
+
+ const parsedWithBlocked = webSearchTool.inputSchema.safeParse({
+ query: "test",
+ provider: "serper-search",
+ });
+ expect(parsedWithBlocked.success).toBe(false);
+ });
+});
diff --git a/open-sse/mcp-server/schemas/providerEnums.ts b/open-sse/mcp-server/schemas/providerEnums.ts
index adb8da067e79..61e4648c0823 100644
--- a/open-sse/mcp-server/schemas/providerEnums.ts
+++ b/open-sse/mcp-server/schemas/providerEnums.ts
@@ -1,12 +1,16 @@
import { SEARCH_PROVIDERS } from "../../config/searchRegistry";
+import { isProviderBlockedByIdOrAlias } from "../../../src/shared/utils/noAuthProviders";
/**
* Dynamically generates a tuple of active search provider IDs for Zod enums.
- * Filters out any providers marked as disabled in the registry.
+ * Filters out any providers marked as disabled or blocked in the security policy.
*/
-export function getActiveSearchProviders(): [string, ...string[]] {
+export function getActiveSearchProviders(blockedProviders: string[] = []): [string, ...string[]] {
const activeProviders = Object.values(SEARCH_PROVIDERS)
- .filter((provider) => !provider.disabled)
+ .filter(
+ (provider) =>
+ !provider.disabled && !isProviderBlockedByIdOrAlias(provider.id, blockedProviders)
+ )
.map((provider) => provider.id);
if (activeProviders.length === 0) {
diff --git a/open-sse/mcp-server/schemas/tools.ts b/open-sse/mcp-server/schemas/tools.ts
index 7b8e459180e0..d8d83c17ea5d 100644
--- a/open-sse/mcp-server/schemas/tools.ts
+++ b/open-sse/mcp-server/schemas/tools.ts
@@ -462,25 +462,29 @@ export const listModelsCatalogTool: McpToolDefinition<
};
// --- Tool 10: omniroute_web_search ---
-export const webSearchInput = z.object({
- query: z
- .string()
- .min(1, "Query is required")
- .max(500, "Query must be 500 characters or fewer")
- .describe("The search query string"),
- max_results: z
- .number()
- .int()
- .min(1)
- .max(20)
- .default(5)
- .describe("Maximum number of search results to return"),
- search_type: z.enum(["web", "news"]).default("web").describe("Type of search to perform"),
- provider: z
- .enum(getActiveSearchProviders())
- .optional()
- .describe("Specific search provider to use"),
-});
+export function buildWebSearchInputSchema(blockedProviders: string[] = []) {
+ return z.object({
+ query: z
+ .string()
+ .min(1, "Query is required")
+ .max(500, "Query must be 500 characters or fewer")
+ .describe("The search query string"),
+ max_results: z
+ .number()
+ .int()
+ .min(1)
+ .max(20)
+ .default(5)
+ .describe("Maximum number of search results to return"),
+ search_type: z.enum(["web", "news"]).default("web").describe("Type of search to perform"),
+ provider: z
+ .enum(getActiveSearchProviders(blockedProviders))
+ .optional()
+ .describe("Specific search provider to use"),
+ });
+}
+
+export const webSearchInput = buildWebSearchInputSchema();
export const webSearchOutput = z.object({
id: z.string(),
diff --git a/open-sse/mcp-server/server.ts b/open-sse/mcp-server/server.ts
index e5f92a48f189..16e4eb8832eb 100644
--- a/open-sse/mcp-server/server.ts
+++ b/open-sse/mcp-server/server.ts
@@ -18,6 +18,7 @@ import {
costReportInput,
listModelsCatalogInput,
webSearchInput,
+ buildWebSearchInputSchema,
xSearchInput,
webFetchInput,
simulateRouteInput,
@@ -720,7 +721,24 @@ async function handleWebFetch(args: {
}
}
-export function createMcpServer(): McpServer {
+export interface CreateMcpServerOptions {
+ blockedProviders?: string[] | (() => string[]);
+}
+
+export function createMcpServer(options?: CreateMcpServerOptions): McpServer {
+ const resolveBlockedProviders = (): string[] => {
+ if (typeof options?.blockedProviders === "function") {
+ return options.blockedProviders();
+ }
+ if (Array.isArray(options?.blockedProviders)) {
+ return options.blockedProviders;
+ }
+ return [];
+ };
+
+ const blockedProviders = resolveBlockedProviders();
+ const dynamicWebSearchInput = buildWebSearchInputSchema(blockedProviders);
+
const server = new McpServer({
name: "omniroute",
version: process.env.npm_package_version || "1.8.1",
@@ -1044,10 +1062,14 @@ export function createMcpServer(): McpServer {
{
description:
"Performs a web search using OmniRoute's search gateway. Supports multiple providers (Serper, Brave, Perplexity, Exa, Tavily) with automatic failover. Returns search results with titles, URLs, snippets, and position data.",
- inputSchema: webSearchInput,
+ inputSchema: dynamicWebSearchInput,
},
withScopeEnforcement("omniroute_web_search", (args) =>
- handleWebSearch(webSearchInput.parse(args))
+ // Resolve per invocation (not the startup snapshot above) so a resolver
+ // function passed via CreateMcpServerOptions sees policy changes without
+ // a server rebuild. The advertised inputSchema stays a creation-time
+ // snapshot — MCP clients fetch it once at tools/list.
+ handleWebSearch(buildWebSearchInputSchema(resolveBlockedProviders()).parse(args))
)
);
diff --git a/open-sse/mcp-server/tools/memoryTools.ts b/open-sse/mcp-server/tools/memoryTools.ts
index 16c835fd8e51..12a8c99c0d3b 100644
--- a/open-sse/mcp-server/tools/memoryTools.ts
+++ b/open-sse/mcp-server/tools/memoryTools.ts
@@ -10,16 +10,24 @@ import {
import { resolveMcpCallerApiKeyId } from "../mcpCallerIdentity.ts";
/**
- * Resolve the memory owner id for an MCP tool call:
- * explicit arg wins, otherwise fall back to the authenticated caller's
- * principal id (HTTP auth headers on SSE/Streamable HTTP transports,
- * OMNIROUTE_API_KEY env var on stdio). Keeps MCP-stored memories under
- * the same owner id that chat-context memory uses, so retrieval in the
- * chat pipeline finds entries written via MCP.
+ * Resolve the memory owner id for an MCP tool call.
+ *
+ * The authenticated caller's principal ALWAYS wins over a caller-supplied
+ * `apiKeyId` — otherwise any MCP caller could read, write, or delete another
+ * principal's memories by putting a different id in the tool arguments
+ * (GHSA-cpv3-xr7r-xf8q, IDOR). The caller is resolved from the per-request HTTP
+ * auth headers on SSE / Streamable HTTP transports, or from OMNIROUTE_API_KEY on
+ * stdio. The explicit argument is only honored as a fallback when no caller can
+ * be resolved (a bare local stdio process with no configured key — already
+ * trusted), preserving the local-tooling flow. Keeps MCP-stored memories under
+ * the same owner id that chat-context memory uses, so retrieval in the chat
+ * pipeline finds entries written via MCP.
*/
async function resolveMemoryOwnerId(explicit?: string): Promise {
+ const caller = await resolveMcpCallerApiKeyId().catch(() => undefined);
+ if (caller) return caller;
if (explicit && explicit.trim() !== "") return explicit.trim();
- return (await resolveMcpCallerApiKeyId().catch(() => undefined)) || "mcp";
+ return "mcp";
}
export const MemorySearchSchema = z.object({
diff --git a/open-sse/services/accountFallback.ts b/open-sse/services/accountFallback.ts
index d63c58e94ce9..63407a38fcc8 100644
--- a/open-sse/services/accountFallback.ts
+++ b/open-sse/services/accountFallback.ts
@@ -21,7 +21,11 @@ import {
honorsRuleLockScope,
} from "../config/providerErrorRules.ts";
import * as rot from "./rotationConfig.ts";
-import { getPassthroughProviders, getProviderCategory } from "../config/providerRegistry.ts";
+import {
+ getPassthroughProviders,
+ getProviderCategory,
+ isLocalProvider,
+} from "../config/providerRegistry.ts";
import {
DEFAULT_RESILIENCE_SETTINGS,
resolveResilienceSettings,
@@ -37,7 +41,12 @@ import {
type FailureKind,
} from "../../src/shared/utils/classify429";
import { recordProviderSuccess as resetCooldownFailureCount } from "./providerCooldownTracker.ts";
-import { resolveProviderId } from "../../src/shared/constants/providers";
+import {
+ getProviderById,
+ resolveProviderId,
+ isLocalProvider as isLocalProviderId,
+ isSelfHostedChatProvider,
+} from "../../src/shared/constants/providers";
import { resolveUseUpstream429BreakerHints } from "../../src/shared/utils/providerHints";
import { getCodexModelScope } from "../config/codexQuotaScopes.ts";
import { getQuotaScopedModelForProvider } from "./antigravityQuotaFamily.ts";
@@ -791,12 +800,20 @@ export function hasPerModelQuota(
return connectionPassthroughModels;
}
if (!provider) return false;
- if (getCanonicalLockProvider(provider) === "antigravity") return true;
- if (getCanonicalLockProvider(provider) === "codex") return true;
- if (provider === "gemini" || provider === "github") return true;
- if (provider === "antigravity" || provider === "agy") return true;
- if (getPassthroughProviders().has(provider)) return true;
- if (isCompatibleProvider(provider)) return true;
+ const canonicalId = resolveProviderId(provider);
+ if (getCanonicalLockProvider(canonicalId) === "antigravity") return true;
+ if (getCanonicalLockProvider(canonicalId) === "codex") return true;
+ if (canonicalId === "gemini" || canonicalId === "github") return true;
+ if (canonicalId === "antigravity" || canonicalId === "agy") return true;
+ if (getPassthroughProviders().has(canonicalId)) return true;
+ // #11071: getPassthroughProviders() reads the open-sse REGISTRY. A provider can declare
+ // passthroughModels:true in the SHARED registry (src/shared/constants/providers/) and be
+ // absent from that set — 40 of them are, and they are neither local nor self-hosted, so the
+ // branch below never reaches them either. Without this lookup a missing-model 404 on one of
+ // those cools the whole connection instead of locking out the single model.
+ if (getProviderById(canonicalId)?.passthroughModels === true) return true;
+ if (isCompatibleProvider(canonicalId)) return true;
+ if (isLocalProviderId(canonicalId) || isSelfHostedChatProvider(canonicalId)) return true;
return false;
}
diff --git a/open-sse/services/autoCombo/virtualFactory.ts b/open-sse/services/autoCombo/virtualFactory.ts
index 9fa12875637c..28071144fbb2 100644
--- a/open-sse/services/autoCombo/virtualFactory.ts
+++ b/open-sse/services/autoCombo/virtualFactory.ts
@@ -607,7 +607,7 @@ export async function prepareVirtualAutoComboInputs(
// remaining allowance as a percentage, and a raw ">0" comparison would
// let a reading of e.g. 0.3% (rounding noise, not real headroom) pass.
minRemainingAllowance: 1,
- maxStateAgeMs: (settings.autoRefreshProviderQuotaInterval ?? 180) * 1000,
+ maxStateAgeMs: (Number(settings.autoRefreshProviderQuotaInterval) || 180) * 1000,
});
if (strictFilteredPool !== pool) pool = strictFilteredPool;
diff --git a/open-sse/services/claudeCodeToolRemapper.ts b/open-sse/services/claudeCodeToolRemapper.ts
index 15995a95003f..82e408e7c872 100644
--- a/open-sse/services/claudeCodeToolRemapper.ts
+++ b/open-sse/services/claudeCodeToolRemapper.ts
@@ -57,6 +57,10 @@ const TOOL_RENAME_MAP: Record = {
cronlist: "CronList",
taskoutput: "TaskOutput",
taskstop: "TaskStop",
+ taskcreate: "TaskCreate",
+ taskupdate: "TaskUpdate",
+ tasklist: "TaskList",
+ taskget: "TaskGet",
workflow: "Workflow",
};
@@ -205,14 +209,22 @@ export function remapToolNamesInResponse(
* Restore a tool name for Claude-format clients (#9008).
*
* Preference order:
- * 1. Exact `_toolNameMap` hit (sanitized → original)
- * 2. Case-insensitive match against map keys/values (Gemini/Antigravity may
- * echo a lowercased name for a PascalCase Claude Code tool)
- * 3. REVERSE_MAP TitleCase → lowercase fallback for clients with no request map
- * (#7926 XML / OpenCode-style lowercase tools)
+ * 1. Exact `_toolNameMap` hit where the value differs from the key
+ * (sanitized → original request-side alias)
+ * 2. Canonical casing upgrade for known Claude Code tools
+ * (`croncreate` → `CronCreate`, `bash` → `Bash`, …)
+ * 3. Case-insensitive non-identity match against map keys/values
+ * (Gemini/Antigravity may echo a lowercased name for a PascalCase
+ * Claude Code tool)
+ * 4. Identity echo kept ONLY when no canonical upgrade exists
+ * 5. No-map fallbacks: REVERSE_MAP TitleCase → lowercase (#7926 XML /
+ * OpenCode-style lowercase tools), then the static table
*
- * Never apply REVERSE_MAP after a request-side original is known — that is what
- * turned Claude Code's `Read`/`WebSearch` into `read`/`websearch`.
+ * Identity entries (key === value) never pin a known tool below its
+ * canonical casing. Some upstream gateways echo the very lowercase name
+ * they emitted into the alias channel; honouring that echo is what let a
+ * literal `croncreate` reach Claude Code as an unknown tool even though
+ * the request declared `CronCreate`.
*/
export function restoreClaudeToolName(
rawName: string,
@@ -220,27 +232,49 @@ export function restoreClaudeToolName(
): string {
if (!rawName) return rawName;
- const exact = toolNameMap?.get(rawName);
- if (typeof exact === "string") return exact;
+ // Undefined when rawName already IS the canonical form — an input that
+ // maps to itself must keep flowing to the #7926 legacy paths below.
+ const lower = rawName.toLowerCase();
+ const canonicalRaw = TOOL_RENAME_MAP[lower];
+ const canonical = canonicalRaw && canonicalRaw !== rawName ? canonicalRaw : undefined;
if (toolNameMap?.size) {
- const lower = rawName.toLowerCase();
+ const exact = toolNameMap.get(rawName);
+ if (typeof exact === "string" && (exact !== rawName || !canonical)) {
+ return exact;
+ }
+
+ let identityMatch: string | undefined;
for (const [sanitized, original] of toolNameMap.entries()) {
- if (sanitized.toLowerCase() === lower || original.toLowerCase() === lower) {
+ if (sanitized.toLowerCase() !== lower && original.toLowerCase() !== lower) {
+ continue;
+ }
+ if (original !== rawName) {
return original;
}
+ identityMatch = original;
+ }
+ if (identityMatch !== undefined && !canonical) {
+ return identityMatch;
}
}
+ // Canonical echo is terminal: when the upstream echoes back the exact
+ // canonical form the request declared, keep it verbatim. The #7926
+ // REVERSE_MAP fallbacks below would otherwise downcase it for routes that
+ // carry no _toolNameMap (Claude Code → OpenAI-style upstreams), which is
+ // what let a literal `croncreate` reach Claude Code even though the client
+ // declared `CronCreate` (live repro, PR #11085).
+ if (canonicalRaw === rawName) return rawName;
+
+ if (canonical) return canonical;
+
// When no request toolNameMap is provided (e.g. non-Claude client):
// If rawName is already TitleCase, apply REVERSE_MAP for #7926 backward compatibility (Bash → bash).
if (!toolNameMap && REVERSE_MAP[rawName]) {
return REVERSE_MAP[rawName];
}
- const canonical = TOOL_RENAME_MAP[rawName.toLowerCase()];
- if (canonical) return canonical;
-
return REVERSE_MAP[rawName] ?? rawName;
}
diff --git a/open-sse/services/combo/validateQuality.ts b/open-sse/services/combo/validateQuality.ts
index 7c7f0ce8a927..76ef5546aba4 100644
--- a/open-sse/services/combo/validateQuality.ts
+++ b/open-sse/services/combo/validateQuality.ts
@@ -617,7 +617,18 @@ export async function validateResponseQuality(
try {
json = JSON.parse(text);
} catch {
- if (text.startsWith("data:") || text.startsWith("event:")) return { valid: true };
+ // An SSE stream body is expected for streamed upstreams. Besides `data:` and
+ // `event:` frames, the SSE spec also allows comment lines that begin with a
+ // colon (`:`), which providers use for keep-alives while the model is still
+ // generating — e.g. OpenRouter emits `: OPENROUTER PROCESSING` on slower /
+ // reasoning responses. A stream that opens with such a comment (or with
+ // leading whitespace/newlines) is still a valid stream, not malformed JSON,
+ // so trim and recognize the comment prefix before rejecting. Without this,
+ // otherwise-good streamed completions get failed as "not valid JSON".
+ const trimmed = text.trimStart();
+ if (trimmed.startsWith("data:") || trimmed.startsWith("event:") || trimmed.startsWith(":")) {
+ return { valid: true };
+ }
return { valid: false, reason: "response is not valid JSON" };
}
diff --git a/open-sse/services/compression/engines/ccr/index.ts b/open-sse/services/compression/engines/ccr/index.ts
index d2136fc8f191..92869bfbc9b9 100644
--- a/open-sse/services/compression/engines/ccr/index.ts
+++ b/open-sse/services/compression/engines/ccr/index.ts
@@ -45,7 +45,7 @@ import {
} from "../../../../../src/lib/db/ccrBlocks.ts";
import { createCompressionStats } from "../../stats.ts";
import { queryBlock, type CcrQuery } from "./ccrQuery.ts";
-import { injectCcrProtocolInstruction } from "./protocolInstruction.ts";
+import { callerSupportsCcrRetrieve, injectCcrProtocolInstruction } from "./protocolInstruction.ts";
import type {
CompressionEngine,
CompressionEngineApplyOptions,
@@ -939,6 +939,30 @@ export const ccrEngine: CompressionEngine = {
return { body, compressed: false, stats: null };
}
+ // #7746 follow-up: only callers whose tools[] proves they can reach
+ // omniroute_ccr_retrieve may have content replaced at all. For everyone
+ // else (plain OpenAI-compatible clients — the marker is an MCP-only
+ // contract) replacement would strand the original text behind a hash the
+ // model has no way to resolve. Skip the whole engine for them. The check
+ // is wrapped defensively: a malformed body must fail OPEN (no
+ // compression), never throw into the request pipeline.
+ let callerCanRetrieve = false;
+ try {
+ callerCanRetrieve = callerSupportsCcrRetrieve(body);
+ } catch (err) {
+ // Defensive: the helper is total, but if it ever throws we must fail
+ // OPEN (no compression) — and surface it so a future regression in the
+ // helper is visible instead of silently bypassing compression forever.
+ console.warn(
+ "[compression/ccr] callerSupportsCcrRetrieve threw; skipping compression:",
+ err instanceof Error ? err.message : err
+ );
+ callerCanRetrieve = false;
+ }
+ if (!callerCanRetrieve) {
+ return { body, compressed: false, stats: null };
+ }
+
const minChars =
typeof stepConfig["minChars"] === "number"
? (stepConfig["minChars"] as number)
diff --git a/open-sse/services/contextManager.ts b/open-sse/services/contextManager.ts
index a2d678f107cd..6fe9e94c8e29 100644
--- a/open-sse/services/contextManager.ts
+++ b/open-sse/services/contextManager.ts
@@ -669,13 +669,35 @@ function purifyHistory(messages: Record[], targetTokens: number
result = fixToolPairs(result);
result = stripTrailingAssistantOrphanToolUse(result);
- // Add summary of dropped messages
+ // Add summary of dropped messages. Merge the notice INTO the leading
+ // system/developer message instead of splicing a second system-role message
+ // mid-array: strict gateways (TokenRouter confirmed live 2026-08-22, see the
+ // PROVIDERS_SYSTEM_MUST_BE_FIRST list in src/lib/memory/injection.ts) reject
+ // any system message at index > 0 with HTTP 400 "System message must be at
+ // the beginning". When there is no leading system message, prepend one --
+ // index 0 is accepted by every provider (same slot the old splice used when
+ // system[] was empty).
if (keep < nonSystem.length) {
const dropped = nonSystem.length - keep;
- result.splice(system.length, 0, {
- role: "system",
- content: `[Context compressed: ${dropped} earlier messages removed to fit context window]`,
- });
+ const droppedNotice = `[Context compressed: ${dropped} earlier messages removed to fit context window]`;
+ const first = result[0];
+ if (first && (first.role === "system" || first.role === "developer")) {
+ if (typeof first.content === "string") {
+ result[0] = {
+ ...first,
+ content: first.content ? `${droppedNotice}\n${first.content}` : droppedNotice,
+ };
+ } else if (Array.isArray(first.content)) {
+ result[0] = {
+ ...first,
+ content: [{ type: "text", text: droppedNotice }, ...(first.content as unknown[])],
+ };
+ } else {
+ result[0] = { ...first, content: droppedNotice };
+ }
+ } else {
+ result.unshift({ role: "system", content: droppedNotice });
+ }
}
return result;
diff --git a/open-sse/services/learnedReasoningEffortCaps.ts b/open-sse/services/learnedReasoningEffortCaps.ts
new file mode 100644
index 000000000000..b0125d868375
--- /dev/null
+++ b/open-sse/services/learnedReasoningEffortCaps.ts
@@ -0,0 +1,126 @@
+/**
+ * Learned Reasoning-Effort Caps — reactive capability memory for providers/models
+ * OmniRoute has no static registry entry for (custom OpenAI-compatible connections,
+ * or any registered provider whose registry entry carries no reasoning metadata).
+ *
+ * Same shape as `learnedThinkingCaps.ts` (thinking_budget), generalized from a
+ * numeric budget to an ordinal reasoning_effort scale: on a 4xx whose body
+ * enumerates the accepted values, `base.ts`'s executor calls
+ * `recordLearnedReasoningEffort`, which stores the highest recognized value in a
+ * module-level Map keyed "provider:model" (lowercased). Subsequent requests for
+ * the same provider+model read the cap via `getLearnedReasoningEffort` (consulted
+ * by `sanitizeReasoningEffortForProvider` in `executors/base/reasoningEffort.ts`)
+ * so the 4xx→retry round-trip is paid at most once per process per provider+model.
+ *
+ * In-memory only (same operator-accepted tradeoff as the thinking-budget cache):
+ * restart resets, the first request after a restart may re-learn at the cost of
+ * one upstream 4xx.
+ */
+
+export const REASONING_EFFORT_ORDER: readonly string[] = [
+ "none",
+ "minimal",
+ "low",
+ "medium",
+ "high",
+ "xhigh",
+ "max",
+];
+
+// key: `${provider}:${model}` lowercased → highest value known to be accepted.
+const learnedCaps = new Map();
+
+function buildKey(provider: string | null | undefined, model: string | null | undefined): string {
+ const p = typeof provider === "string" ? provider.trim().toLowerCase() : "";
+ const m = typeof model === "string" ? model.trim().toLowerCase() : "";
+ if (!p || !m) return "";
+ return `${p}:${m}`;
+}
+
+function rankOf(value: string): number {
+ return REASONING_EFFORT_ORDER.indexOf(value);
+}
+
+/**
+ * Return the learned cap for provider+model, or null when nothing has been
+ * learned yet (no upstream 4xx recorded). Keyed case-insensitively.
+ */
+export function getLearnedReasoningEffort(
+ provider: string | null | undefined,
+ model: string | null | undefined
+): string | null {
+ const key = buildKey(provider, model);
+ if (!key) return null;
+ return learnedCaps.get(key) ?? null;
+}
+
+/**
+ * Record that `acceptedValues` is the enum the upstream advertised for
+ * provider+model, and store the highest recognized value as the learned cap.
+ * Returns the stored value, or null when `acceptedValues` contained no token
+ * from `REASONING_EFFORT_ORDER` (nothing usable to learn) or the key is unusable.
+ *
+ * Always monotonically decreases: if a cap already stored ranks lower than the
+ * newly computed highest, the stored (lower) value wins and is returned
+ * unchanged. This keeps a later, laxer-looking response (or a race between
+ * concurrent requests) from ratcheting the cap back up.
+ */
+export function recordLearnedReasoningEffort(
+ provider: string | null | undefined,
+ model: string | null | undefined,
+ acceptedValues: string[]
+): string | null {
+ const key = buildKey(provider, model);
+ if (!key) return null;
+
+ let best: string | null = null;
+ let bestRank = -1;
+ for (const raw of acceptedValues) {
+ const rank = rankOf(raw);
+ if (rank > bestRank) {
+ bestRank = rank;
+ best = raw;
+ }
+ }
+ if (best === null) return null;
+
+ const existing = learnedCaps.get(key);
+ if (existing !== undefined && rankOf(existing) <= bestRank) {
+ return existing; // already learned an equal-or-lower cap; keep it
+ }
+ learnedCaps.set(key, best);
+ return best;
+}
+
+// Matches both prose shapes observed: OVH's `@ai-sdk/openai-compatible`
+// deserializer ("expected one of `a`, `b`") and a generic vendor prose form
+// ("Supported types are a, b, and c").
+const LIST_INTRO = /(?:expected one of|supported (?:types|values) are)[:\s]*([^.]+)/i;
+
+/**
+ * Extract the upstream-advertised accepted reasoning_effort values from a 4xx
+ * error body. Returns only tokens present in REASONING_EFFORT_ORDER (unknown
+ * tokens are dropped defensively) in the order they appeared, or null when the
+ * text names no recognized enum member.
+ */
+export function parseReasoningEffortEnum(errText: unknown): string[] | null {
+ if (typeof errText !== "string" || !errText) return null;
+ const match = LIST_INTRO.exec(errText);
+ if (!match) return null;
+ const tokens = match[1]
+ .split(/,|\band\b|&/i)
+ .map((t) =>
+ t
+ .replace(/`/g, "")
+ .replace(/\([^)]*\)/g, "")
+ .trim()
+ .toLowerCase()
+ )
+ .filter((t) => t.length > 0 && REASONING_EFFORT_ORDER.includes(t));
+ return tokens.length > 0 ? tokens : null;
+}
+
+/** Test-only: clear the learned-cap Map between tests. */
+export function __test_resetLearnedReasoningEffortCaps(): void {
+ learnedCaps.clear();
+}
diff --git a/open-sse/services/reasoningInputPolicy.ts b/open-sse/services/reasoningInputPolicy.ts
index 71a283a706d8..0e9e8d194dbf 100644
--- a/open-sse/services/reasoningInputPolicy.ts
+++ b/open-sse/services/reasoningInputPolicy.ts
@@ -1,5 +1,6 @@
import { REGISTRY } from "../config/providerRegistry.ts";
import type { ReasoningTransport } from "../config/providerRegistry.ts";
+import { isValidResponsesItemId } from "./responsesItemId.ts";
type JsonRecord = Record;
@@ -36,7 +37,6 @@ export interface ReasoningInputPolicyOptions {
export interface ReasoningInputPolicyResult {
incompatibleReasoning: boolean;
}
-
export function resolveReasoningTransport(
provider: string | null | undefined,
preserveEncryptedReasoning = false
@@ -46,18 +46,6 @@ export function resolveReasoningTransport(
return transport ?? (preserveEncryptedReasoning ? "opaque" : "plaintext");
}
-export function createReasoningTransportIncompatibleError(): Error & {
- statusCode: number;
- errorType: string;
-} {
- const error = new Error(
- "Reasoning continuation is not compatible with the selected target"
- ) as Error & { statusCode: number; errorType: string };
- error.statusCode = 400;
- error.errorType = "reasoning_transport_incompatible";
- return error;
-}
-
function asRecord(value: unknown): JsonRecord | null {
return value && typeof value === "object" && !Array.isArray(value) ? (value as JsonRecord) : null;
}
@@ -100,11 +88,12 @@ function hasChatPlaintextReasoning(record: JsonRecord): boolean {
/**
* Returns only provider-authentic plaintext continuation state. Display summaries
- * are excluded, and a record carrying opaque state is never cross-converted.
+ * and opaque-only records are excluded. Explicit plaintext remains independently
+ * portable when the same record also carries an opaque companion (#10949).
*/
export function extractReplayableResponsesReasoningText(value: unknown): string {
const record = asRecord(value);
- if (!record || record.type !== "reasoning" || hasOpaqueReasoningState(record)) return "";
+ if (!record || record.type !== "reasoning") return "";
if (!Array.isArray(record.content)) return "";
return record.content
@@ -279,22 +268,36 @@ function sanitizeResponsesInput(
if (!hasPlaintext && !hasOpaque && (!hasDisplaySummary(next) || stripOrphanedSummaries)) {
continue;
}
- if (!hasOpaque && typeof next.id === "string") delete next.id;
+ // `id` is only worth keeping on an opaque item with a valid string value —
+ // non-opaque items don't replay their id, and a malformed value (e.g. `null`,
+ // observed on opencode/zen) must not survive either way (#11108).
+ if (!hasOpaque || !isValidResponsesItemId(next.id)) delete next.id;
+ // Some upstreams (e.g. opencode/zen) omit `summary` entirely on opaque
+ // reasoning items instead of sending an empty array. Replaying that shape
+ // verbatim trips strict Responses-API validators that require the field
+ // to be present on every `input[]` item of type `reasoning` (#11108).
+ // Plaintext-only items intentionally have no `summary` key and must stay
+ // untouched.
+ if (hasOpaque && next.summary === undefined) next.summary = [];
filtered.push(next);
continue;
}
const cloned = { ...record };
- if (typeof cloned.id === "string") delete cloned.id;
+ // Strip `id` whenever present, valid or not: these items don't need a
+ // replayed server id, and a malformed one (e.g. `null`, same opencode/zen
+ // omission pattern as the reasoning branch above) must not survive either
+ // (#11108).
+ if (cloned.id !== undefined) delete cloned.id;
filtered.push(cloned);
}
return filtered;
}
/**
- * Applies one protocol-independent compatibility decision before request translation.
- * Plaintext is portable by default; opaque state requires an explicit target declaration.
- * Display summaries do not affect compatibility; stateless input drops orphan summaries.
+ * Projects reasoning continuation onto the selected target transport.
+ * Incompatible active state is dropped by default; combo routing may reject an
+ * attempt instead so it can fall through without mutating the request.
*/
export function applyReasoningInputPolicy(
body: Record,
@@ -306,14 +309,17 @@ export function applyReasoningInputPolicy(
inputFormat === "responses"
? inspectResponsesReasoning(body.input)
: inspectChatReasoning(body.messages);
- const incompatibleReasoning = !isReasoningCompatible(inspection, transport);
+ const mixedState = inspection.hasPlaintext && inspection.hasOpaque;
+ const incompatibleReasoning = !mixedState && !isReasoningCompatible(inspection, transport);
+ // Mixed plaintext + opaque input (#10949) is never a rejection: it is projected
+ // onto the target transport by the per-item sanitizers below.
- if (incompatibleReasoning && options.onIncompatibleReasoning !== "drop") {
+ if (incompatibleReasoning && options.onIncompatibleReasoning === "reject") {
return { incompatibleReasoning: true };
}
if (inputFormat === "chat") {
- if (incompatibleReasoning && Array.isArray(body.messages)) {
+ if ((incompatibleReasoning || mixedState) && Array.isArray(body.messages)) {
body.messages = dropIncompatibleChatReasoning(body.messages, transport);
}
return { incompatibleReasoning: false };
@@ -328,12 +334,13 @@ export function applyReasoningInputPolicy(
},
];
}
- if (!Array.isArray(body.input)) return { incompatibleReasoning: false };
- body.input = sanitizeResponsesInput(
- body.input,
- transport,
- incompatibleReasoning,
- body.store === false
- );
+ if (Array.isArray(body.input)) {
+ body.input = sanitizeResponsesInput(
+ body.input,
+ transport,
+ incompatibleReasoning || mixedState,
+ body.store === false
+ );
+ }
return { incompatibleReasoning: false };
}
diff --git a/open-sse/services/responsesInputSanitizer.ts b/open-sse/services/responsesInputSanitizer.ts
index 5d81b787a10e..94cd99f934b1 100644
--- a/open-sse/services/responsesInputSanitizer.ts
+++ b/open-sse/services/responsesInputSanitizer.ts
@@ -1,3 +1,5 @@
+import { isValidResponsesItemId } from "./responsesItemId.ts";
+
type JsonRecord = Record;
type SanitizeResponsesInputOptions = {
dropInternalAssistantMessages?: boolean;
@@ -40,7 +42,12 @@ function sanitizeFunctionName(name: string): string {
}
function sanitizeInputItemId(record: JsonRecord): JsonRecord {
- if (typeof record.id !== "string") return record;
+ if (record.id === undefined) return record;
+ if (!isValidResponsesItemId(record.id)) {
+ const next = { ...record };
+ delete next.id;
+ return next;
+ }
const type = typeof record.type === "string" ? record.type : "";
const expectedPrefix = SERVER_ITEM_ID_PREFIX_BY_TYPE[type];
diff --git a/open-sse/services/responsesItemId.ts b/open-sse/services/responsesItemId.ts
new file mode 100644
index 000000000000..a57ac92e42f2
--- /dev/null
+++ b/open-sse/services/responsesItemId.ts
@@ -0,0 +1,7 @@
+// Shared by reasoningInputPolicy.ts and responsesInputSanitizer.ts: both strip a
+// Responses-API `input[]` item's `id` field when it isn't a valid string before
+// replay, so a malformed value (e.g. `null`, observed on opencode/zen) never
+// survives to trip a strict upstream with "Expected 'id' to be a string." (#11108).
+export function isValidResponsesItemId(id: unknown): id is string {
+ return typeof id === "string";
+}
diff --git a/open-sse/services/streamRecovery.ts b/open-sse/services/streamRecovery.ts
index a0a397fd87be..3a95e9a2a3fe 100644
--- a/open-sse/services/streamRecovery.ts
+++ b/open-sse/services/streamRecovery.ts
@@ -183,10 +183,33 @@ export function hasTerminalMarker(bytes: Uint8Array): boolean {
export interface OpenAiSseScan {
/** Concatenated assistant text seen across `choices[].delta.content`. */
text: string;
+ /** Concatenated reasoning trace seen across `choices[].delta.reasoning_content`. Some
+ * providers stream the entire answer here and leave `content` empty/null — tracked
+ * separately so a clean stop with reasoning-only output can still be recognized as
+ * "nothing usable was delivered" instead of "a normal empty turn". */
+ reasoningText: string;
/** True if any `choices[].delta.tool_calls` appeared — NEVER continue those. */
sawToolCall: boolean;
- /** True if a terminal marker (`[DONE]` or a non-null `finish_reason`) appeared. */
+ /**
+ * True only when `tool_calls` appeared in this scan AND its own
+ * `finish_reason: "tool_calls"` has NOT also appeared in the same scan — i.e. the
+ * call is still being streamed (arguments may be mid-flight). Once
+ * `finish_reason: "tool_calls"` closes it, the call is complete, not in flight: the
+ * client has the full arguments and a truncation past this point only drops
+ * trailing prose, which continuation can safely recover.
+ */
+ sawToolCallInFlight: boolean;
+ /**
+ * True if a terminal marker for the OVERALL stream appeared: `[DONE]`, or a
+ * `finish_reason` other than `"tool_calls"`. A `finish_reason: "tool_calls"` ends
+ * that one choice but is not terminal for continuation purposes — the model turn
+ * (and the client-visible SSE) is still eligible to be resumed past it.
+ */
terminal: boolean;
+ /** The literal `finish_reason` string when present (e.g. "stop", "tool_calls", "length",
+ * "content_filter"), or `null` if none was seen. `terminal` alone is not precise enough
+ * to gate the reasoning-only-stop continuation — it must fire on `"stop"` only. */
+ finishReason: string | null;
/** True if at least one OpenAI-shaped `choices[].delta` was parsed (format gate). */
parsedOpenAi: boolean;
}
@@ -198,11 +221,22 @@ export interface OpenAiSseScan {
*/
export function scanOpenAiSseText(sse: string): OpenAiSseScan {
let text = "";
+ let reasoningText = "";
let sawToolCall = false;
+ let toolCallFinished = false;
let terminal = false;
+ let finishReason: string | null = null;
let parsedOpenAi = false;
if (typeof sse !== "string" || sse.length === 0) {
- return { text, sawToolCall, terminal, parsedOpenAi };
+ return {
+ text,
+ reasoningText,
+ sawToolCall,
+ sawToolCallInFlight: false,
+ terminal,
+ finishReason,
+ parsedOpenAi,
+ };
}
for (const line of sse.split("\n")) {
const trimmed = line.trimStart();
@@ -227,14 +261,33 @@ export function scanOpenAiSseText(sse: string): OpenAiSseScan {
parsedOpenAi = true;
const content = (delta as { content?: unknown }).content;
if (typeof content === "string") text += content;
+ const reasoning = (delta as { reasoning_content?: unknown }).reasoning_content;
+ if (typeof reasoning === "string") reasoningText += reasoning;
const toolCalls = (delta as { tool_calls?: unknown }).tool_calls;
if (Array.isArray(toolCalls) && toolCalls.length > 0) sawToolCall = true;
}
- const finishReason = (choice as { finish_reason?: unknown })?.finish_reason;
- if (finishReason != null) terminal = true;
+ const rawFinishReason = (choice as { finish_reason?: unknown })?.finish_reason;
+ if (rawFinishReason === "tool_calls") {
+ // Ends this one choice, but the overall stream/turn stays continuable —
+ // never counts as the general terminal marker (see OpenAiSseScan.terminal).
+ toolCallFinished = true;
+ finishReason = "tool_calls";
+ } else if (rawFinishReason != null) {
+ terminal = true;
+ if (typeof rawFinishReason === "string") finishReason = rawFinishReason;
+ }
}
}
- return { text, sawToolCall, terminal, parsedOpenAi };
+ const sawToolCallInFlight = sawToolCall && !toolCallFinished;
+ return {
+ text,
+ reasoningText,
+ sawToolCall,
+ sawToolCallInFlight,
+ terminal,
+ finishReason,
+ parsedOpenAi,
+ };
}
export interface ContinuableBody {
@@ -245,8 +298,10 @@ export interface ContinuableBody {
/**
* Build a re-request body that continues from `assistantSoFar` by appending it as an
- * assistant turn. Returns null when the body has no `messages` array or the partial text
- * is empty (nothing to continue from). Does not mutate the original.
+ * assistant turn. When `assistantSoFar` is empty (nothing usable was emitted yet — e.g. a
+ * clean stop that only produced reasoning), the messages are re-sent unchanged instead of
+ * appending an empty assistant turn: this simply re-asks for a real answer. Returns null
+ * only when the body has no `messages` array at all (nothing to continue from).
*/
export function makeContinuationBody(
body: ContinuableBody,
@@ -254,10 +309,13 @@ export function makeContinuationBody(
): (ContinuableBody & { messages: unknown[] }) | null {
if (!body || typeof body !== "object") return null;
if (!Array.isArray(body.messages) || body.messages.length === 0) return null;
- if (typeof assistantSoFar !== "string" || assistantSoFar.length === 0) return null;
+ if (typeof assistantSoFar !== "string") return null;
return {
...body,
- messages: [...body.messages, { role: "assistant", content: assistantSoFar }],
+ messages:
+ assistantSoFar.length > 0
+ ? [...body.messages, { role: "assistant", content: assistantSoFar }]
+ : [...body.messages],
stream: true,
};
}
@@ -368,8 +426,13 @@ export function createRecoverableStream(
let continuations = 0;
let emittedTail = ""; // raw SSE not yet scanned (awaiting an event boundary)
let emittedText = ""; // assistant text already delivered to the client
+ let emittedReasoningText = ""; // reasoning trace already delivered (never shown to the client,
+ // tracked only to distinguish "a real empty turn" from "the whole
+ // answer stayed in the reasoning channel")
+ let emittedFinishReason: string | null = null; // literal finish_reason last seen, if any
let emittedTerminal = false;
- let emittedToolCall = false;
+ let emittedToolCallInFlight = false;
+ let emittedSawToolCall = false; // any tool_call delta seen, complete or not
let emittedParsedOpenAi = false;
// Enqueue to the client and, when continuation is enabled, fold the chunk into the
@@ -387,8 +450,11 @@ export function createRecoverableStream(
emittedTail = emittedTail.slice(boundary + 2);
const scan = scanOpenAiSseText(complete);
emittedText += scan.text;
+ emittedReasoningText += scan.reasoningText;
+ if (scan.finishReason !== null) emittedFinishReason = scan.finishReason;
if (scan.terminal) emittedTerminal = true;
- if (scan.sawToolCall) emittedToolCall = true;
+ if (scan.sawToolCallInFlight) emittedToolCallInFlight = true;
+ if (scan.sawToolCall) emittedSawToolCall = true;
if (scan.parsedOpenAi) emittedParsedOpenAi = true;
};
@@ -396,15 +462,42 @@ export function createRecoverableStream(
for (const chunk of holdback.flush()) emit(controller, chunk);
};
- // A post-commit truncation is continuable only for a plain-text OpenAI-compatible
- // stream that has not finished and has no tool call in flight.
+ // A post-commit truncation is continuable for a plain-text OpenAI-compatible stream that
+ // has no tool call in flight, AND either:
+ // - has not finished yet (the original #4131 truncation case), or
+ // - finished with a literal finish_reason of "stop" but delivered nothing usable while a
+ // non-empty reasoning trace shows the provider spent its whole turn "thinking" and never
+ // turned that into an answer (some providers put the entire response in
+ // reasoning_content and leave content empty). Gated on the LITERAL "stop" value, not the
+ // generic `terminal` flag — `terminal` also covers "length"/"content_filter"/a bare
+ // [DONE], which are out of scope for this specific recovery.
+ //
+ // Known consequence of the hallucinatedEmptyStop path (flagged in cross-review, accepted as
+ // inherent to tryContinue's existing design, not new to this fix): the original upstream's
+ // `finish_reason:"stop"` chunk was already forwarded to the client via `emit()`'s unconditional
+ // `controller.enqueue(chunk)` (streamRecovery.ts:381) BEFORE this scan ever runs — that is how
+ // `emittedFinishReason`/`emittedTerminal` get set in the first place. So the client sees an
+ // empty "stop" marker from the original turn, then — once the continuation succeeds — the real
+ // answer plus a SECOND `emitCleanTerminal` from `tryContinue`. This mirrors what already
+ // happens for the pre-existing truncation-continuation case (a truncated stream can likewise
+ // have partially delivered SSE framing before `tryContinue` appends more); it is not a new
+ // double-close of the underlying `ReadableStream` (`controller.close()` runs exactly once,
+ // after `tryContinue` returns). An SSE client that treats a bare `finish_reason:"stop"` as an
+ // unconditional end-of-turn (rather than waiting for `[DONE]`) may need updating separately —
+ // out of scope for this fix, which targets the observed opencode/OmniRoute pairing where the
+ // client kept the connection open.
+ const hallucinatedEmptyStop = () =>
+ emittedFinishReason === "stop" &&
+ !emittedSawToolCall &&
+ emittedText.length === 0 &&
+ emittedReasoningText.length > 0;
+
const canContinue = () =>
continueEnabled &&
continuations < maxContinuations &&
emittedParsedOpenAi &&
- !emittedToolCall &&
- !emittedTerminal &&
- emittedText.length > 0;
+ !emittedToolCallInFlight &&
+ (emittedText.length > 0 ? !emittedTerminal : hallucinatedEmptyStop());
const emitCleanTerminal = (controller: ReadableStreamDefaultController) => {
controller.enqueue(
@@ -448,7 +541,24 @@ export function createRecoverableStream(
}
const scan = scanOpenAiSseText(raw);
- const suffix = trimContinuationOverlap(emittedText, scan.text);
+ // A continuation whose overlap with what was already emitted falls below the documented
+ // threshold is treated as a suspected restart rather than a real resume — see
+ // STREAM_RECOVERY.MIN_CONTINUATION_OVERLAP_CHARS for the full trade-off rationale. This
+ // is a heuristic, not a proof: it deliberately trades some false-positive rejections of
+ // legitimate low-overlap continuations against never silently gluing two unrelated
+ // fragments into one corrupted message.
+ const overlapResult = trimContinuationOverlap(emittedText, scan.text);
+ const overlapChars = scan.text.length - overlapResult.length;
+ const isSuspectedRestart =
+ emittedText.length > 0 &&
+ scan.text.length > 0 &&
+ overlapChars < STREAM_RECOVERY.MIN_CONTINUATION_OVERLAP_CHARS;
+ if (isSuspectedRestart) {
+ if (await tryContinue(controller)) return true;
+ emitCleanTerminal(controller);
+ return true;
+ }
+ const suffix = overlapResult;
if (suffix) {
emit(
controller,
@@ -505,9 +615,11 @@ export function createRecoverableStream(
const { done, value } = result;
if (done) {
if (holdback.committed) {
- // Graceful end after commit: if it lacks a terminal marker it is a silent
- // truncation — try to continue; otherwise (clean finish) just close.
- if (!emittedTerminal && (await tryContinue(controller))) {
+ // Graceful end after commit: try a mid-stream continuation whenever canContinue()
+ // says the stream is worth continuing (silent truncation, or a clean-but-empty
+ // reasoning-only stop) — canContinue() is the single source of truth here, same as
+ // the read-error branch above.
+ if (await tryContinue(controller)) {
runFinalize();
controller.close();
return;
diff --git a/open-sse/translator/request/openai-responses.ts b/open-sse/translator/request/openai-responses.ts
index b88665025242..d48dcdf18161 100644
--- a/open-sse/translator/request/openai-responses.ts
+++ b/open-sse/translator/request/openai-responses.ts
@@ -8,11 +8,7 @@ import { isOpenAIResponsesStoreEnabled } from "@/lib/providers/requestDefaults";
import { FORMATS } from "../formats.ts";
import { register } from "../registry.ts";
import { normalizeResponsesInputForChat } from "../../utils/responsesInputNormalization.ts";
-import {
- createReasoningTransportIncompatibleError,
- hasOpaqueReasoningState,
- extractReplayableResponsesReasoningText,
-} from "../../services/reasoningInputPolicy.ts";
+import { extractReplayableResponsesReasoningText } from "../../services/reasoningInputPolicy.ts";
import {
getRegisteredProviders,
requiresPlainStringContent,
@@ -454,10 +450,8 @@ export function openaiResponsesToOpenAIRequest(
if (itemType === "reasoning") {
// Only genuine plaintext reasoning can cross into Chat reasoning_content.
- // Opaque encrypted state and its display summary have no Chat replay form.
- if (preserveReasoningContent && hasOpaqueReasoningState(item)) {
- throw createReasoningTransportIncompatibleError();
- }
+ // Opaque encrypted state and its display summary have no Chat replay form,
+ // so opaque-only items are dropped while mixed items replay their plaintext.
if (preserveReasoningContent) {
const reasoning = extractReplayableResponsesReasoningText(item);
if (reasoning) {
diff --git a/open-sse/translator/request/openai-responses/toResponses.ts b/open-sse/translator/request/openai-responses/toResponses.ts
index bee5efab1a27..988835edeace 100644
--- a/open-sse/translator/request/openai-responses/toResponses.ts
+++ b/open-sse/translator/request/openai-responses/toResponses.ts
@@ -201,6 +201,14 @@ export function openaiToOpenAIResponsesRequest(
input.push({
type: "reasoning",
content: [{ type: "reasoning_text", text: reasoning }],
+ // Strict Responses-API upstreams (e.g. opencode/zen) require `summary`
+ // on every `input[]` item of type "reasoning", plaintext or opaque —
+ // omitting it rejects the request with `input[N] missing required
+ // field summary`. This item is always freshly built from a chat
+ // client's plaintext reasoning, so there is no source summary to
+ // preserve; default to an empty array like the replay sanitizer does
+ // for opaque items in reasoningInputPolicy.ts (#11108).
+ summary: [],
});
}
diff --git a/open-sse/translator/response/openai-responses.ts b/open-sse/translator/response/openai-responses.ts
index 0c59fac4fba6..01ad55d72f28 100644
--- a/open-sse/translator/response/openai-responses.ts
+++ b/open-sse/translator/response/openai-responses.ts
@@ -866,21 +866,25 @@ export function openaiResponsesToOpenAIResponse(chunk, state) {
function openaiResponsesToOpenAIResponseStream(chunk, state) {
if (!chunk) {
- if (
- state.currentToolCallNeedsNormalization &&
- state.currentToolCallArgsBuffer &&
- state.currentToolCallName
- ) {
- const toolSchema = state.toolSchemas?.get(state.currentToolCallName);
- const argsToEmit = stripEmptyOptionalToolArgs(
- state.currentToolCallArgsBuffer,
- state.currentToolCallName,
- toolSchema
- );
- const argsStr =
- typeof argsToEmit === "string" ? argsToEmit : JSON.stringify(argsToEmit ?? {});
- state.currentToolCallArgsBuffer = "";
- state.currentToolCallNeedsNormalization = false;
+ // Iterate every still-open call needing schema-aware normalization, not just a
+ // single one — multiple parallel calls can each be pending here if the stream
+ // ends before their output_item.done arrives.
+ const pendingNormalized: Array<{ index: number; argsStr: string }> = [];
+ if (state.toolCallByCallId instanceof Map) {
+ for (const entry of state.toolCallByCallId.values()) {
+ if (entry.needsNormalization && entry.argsBuffer) {
+ const toolSchema = state.toolSchemas?.get(entry.name);
+ const argsToEmit = stripEmptyOptionalToolArgs(entry.argsBuffer, entry.name, toolSchema);
+ pendingNormalized.push({
+ index: entry.index,
+ argsStr: typeof argsToEmit === "string" ? argsToEmit : JSON.stringify(argsToEmit ?? {}),
+ });
+ entry.argsBuffer = "";
+ entry.needsNormalization = false;
+ }
+ }
+ }
+ if (pendingNormalized.length > 0) {
state.finishReasonSent = true;
state.finishReason = "tool_calls";
const common = {
@@ -889,24 +893,21 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
created: state.created,
model: state.model || "gpt-4",
};
- return [
- {
- ...common,
- choices: [
- {
- index: 0,
- delta: {
- tool_calls: [{ index: state.toolCallIndex, function: { arguments: argsStr } }],
- },
- finish_reason: null,
- },
- ],
- },
- {
- ...common,
- choices: [{ index: 0, delta: {}, finish_reason: "tool_calls" }],
- },
- ];
+ const chunks: Record[] = pendingNormalized.map(({ index, argsStr }) => ({
+ ...common,
+ choices: [
+ {
+ index: 0,
+ delta: { tool_calls: [{ index, function: { arguments: argsStr } }] },
+ finish_reason: null,
+ },
+ ],
+ }));
+ chunks.push({
+ ...common,
+ choices: [{ index: 0, delta: {}, finish_reason: "tool_calls" }],
+ });
+ return chunks;
}
// Flush: send final chunk with finish_reason
if (!state.finishReasonSent && state.started) {
@@ -952,7 +953,23 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
state.chatId = `chatcmpl-${Date.now()}`;
state.created = Math.floor(Date.now() / 1000);
state.toolCallIndex = 0;
+ // Kept for computeFinishReason (synthesizeCompletedToolCalls.ts) compatibility —
+ // that snapshot path mutates it directly and expects it to exist. In a turn with
+ // multiple parallel calls this only ever reflects the LAST one opened/closed, so
+ // it must never be used to identify a specific call — only as the "is at least
+ // one tool call in flight this turn" signal computeFinishReason needs, which
+ // toolCallIndex > 0 already covers on its own once any call has been added.
state.currentToolCallId = null;
+ // Per-call state keyed by call_id (replaces the old singular
+ // currentToolCallId/ArgsBuffer/Name/NeedsNormalization/Deferred fields, which
+ // assumed only one function_call could ever be in flight at a time).
+ state.toolCallByCallId = new Map();
+ // response.function_call_arguments.delta carries `item_id`/`output_index`, not
+ // `call_id` — resolve either one back to the call_id key used by
+ // toolCallByCallId (two independent reverse maps, since some upstreams omit
+ // item_id on delta events but still send output_index).
+ state.toolCallItemToCallId = new Map();
+ state.toolCallOutputIndexToCallId = new Map();
}
// Text content delta
@@ -983,22 +1000,48 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
// Function call started
if (eventType === "response.output_item.added" && data.item?.type === "function_call") {
const item = data.item;
- state.currentToolCallId = item.call_id || fallbackToolCallId();
- state.currentToolCallArgsBuffer = ""; // reset per-call arg buffer
- state.currentToolCallDeferred = false;
+ const callId = item.call_id || fallbackToolCallId();
+ // Kept for computeFinishReason (synthesizeCompletedToolCalls.ts) compatibility.
+ state.currentToolCallId = callId;
+
+ const toolName = normalizeToolName(item.name);
+ // Assign this call's index NOW, at .added, not at .done — two calls opened before
+ // either closes (a genuine parallel dispatch) must never share an index. Deferred
+ // (still-nameless) calls are the one exception: they don't claim an index until
+ // .done resolves a real name, so a call that never gets one never burns a slot
+ // another call could have used.
+ let index: number | null = null;
+ if (toolName) {
+ index = state.toolCallIndex ?? 0;
+ state.toolCallIndex = index + 1;
+ }
+
+ if (!(state.toolCallByCallId instanceof Map)) state.toolCallByCallId = new Map();
+ state.toolCallByCallId.set(callId, {
+ index,
+ name: toolName,
+ argsBuffer: "",
+ deferred: !toolName,
+ needsNormalization: toolName === "Agent",
+ });
+ if (!(state.toolCallItemToCallId instanceof Map)) state.toolCallItemToCallId = new Map();
+ if (item.id) state.toolCallItemToCallId.set(item.id, callId);
+ // `output_index` is a top-level field on every Responses API streamed event
+ // (response.output_item.added/.done AND function_call_arguments.delta alike) —
+ // an identifier independent of item_id, for upstreams that omit item_id on delta
+ // events.
+ if (!(state.toolCallOutputIndexToCallId instanceof Map)) {
+ state.toolCallOutputIndexToCallId = new Map();
+ }
+ if (data.output_index != null) state.toolCallOutputIndexToCallId.set(data.output_index, callId);
// Track this call_id so response.completed doesn't synthesize a duplicate
if (!state.toolCallIdsSeen) state.toolCallIdsSeen = new Set();
- if (state.currentToolCallId) state.toolCallIdsSeen.add(state.currentToolCallId);
+ state.toolCallIdsSeen.add(callId);
- const toolName = normalizeToolName(item.name);
- state.currentToolName = toolName; // track for schema lookup at done time
- state.currentToolCallName = toolName;
- state.currentToolCallNeedsNormalization = toolName === "Agent";
if (!toolName) {
// Some Responses providers briefly emit placeholder/empty tool names.
// Defer emission until output_item.done in case the final name is populated there.
- state.currentToolCallDeferred = true;
return null;
}
@@ -1013,8 +1056,8 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
delta: {
tool_calls: [
{
- index: state.toolCallIndex,
- id: state.currentToolCallId,
+ index,
+ id: callId,
type: "function",
function: {
name: toolName,
@@ -1037,11 +1080,26 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
const argsDelta = data.delta || "";
if (!argsDelta) return null;
- state.currentToolCallArgsBuffer = (state.currentToolCallArgsBuffer || "") + argsDelta;
- if (state.currentToolCallDeferred || state.currentToolCallNeedsNormalization) return null;
+ // Resolve which in-flight call this delta belongs to. Try item_id first (the
+ // field the Responses API documents for this event), then output_index (also a
+ // top-level field on this event, and independent of item_id — covers upstreams
+ // that omit item_id on delta events but still send output_index). Only once both
+ // identifying fields are absent/unresolved do we fall back to guessing (the
+ // single open call, or the most recently opened one as a last resort).
+ const map = state.toolCallByCallId instanceof Map ? state.toolCallByCallId : null;
+ let callId = data.item_id ? state.toolCallItemToCallId?.get(data.item_id) : undefined;
+ if (!callId && data.output_index != null) {
+ callId = state.toolCallOutputIndexToCallId?.get(data.output_index);
+ }
+ if (!callId && map) {
+ callId = map.size === 1 ? [...map.keys()][0] : state.currentToolCallId;
+ }
+ const entry = callId ? map?.get(callId) : undefined;
+ if (!entry) return null;
// #9168: buffer arguments until output_item.done for schema-aware null normalization
// Previously emitted raw null values for optional enum fields (e.g. isolation: null).
+ entry.argsBuffer = (entry.argsBuffer || "") + argsDelta;
return null;
}
@@ -1061,13 +1119,30 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
// carry the complete arguments only in output_item.done (no preceding delta events).
if (eventType === "response.output_item.done" && data.item?.type === "function_call") {
const item = data.item;
- const buffered = state.currentToolCallArgsBuffer || "";
- const currentIndex = state.toolCallIndex; // capture before increment
- const callId = item.call_id || state.currentToolCallId || fallbackToolCallId();
+ const map = state.toolCallByCallId instanceof Map ? state.toolCallByCallId : null;
+ let callId = item.call_id;
+ if (!callId && item.id) callId = state.toolCallItemToCallId?.get(item.id);
+ if (!callId) callId = state.currentToolCallId || fallbackToolCallId();
+ const trackedEntry = callId ? map?.get(callId) : undefined;
+ // Some upstreams (e.g. Codex) send the complete payload only in output_item.done,
+ // with no preceding output_item.added at all — there is no tracked entry to read an
+ // index from.
+ const entry = trackedEntry || { index: null, argsBuffer: "", deferred: false };
+
+ const buffered = entry.argsBuffer || "";
const toolName = normalizeToolName(item.name);
+
+ // Claim (and advance) this call's index now if it wasn't assigned at .added — either
+ // a deferred call whose name has just now resolved, or a Codex-style done-only
+ // payload that never had an .added at all. A deferred call whose name is STILL empty
+ // never claims an index (nothing was ever emitted for it either way).
+ if (entry.index == null && toolName) {
+ entry.index = state.toolCallIndex ?? 0;
+ state.toolCallIndex = entry.index + 1;
+ }
+ const currentIndex = entry.index;
const toolSchema = state.toolSchemas?.get(toolName);
const shouldNormalizeArguments = toolName === "Agent";
- state.currentToolCallNeedsNormalization = shouldNormalizeArguments;
if (toolName && state.toolCalls instanceof Map) {
const completedArguments =
@@ -1077,6 +1152,9 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
toolName,
toolSchema
);
+ // Keyed by index, not insertion order — readers that need call order for
+ // parallel calls closed out of order should sort by this key rather than
+ // relying on Map iteration order.
state.toolCalls.set(currentIndex, {
id: callId,
index: currentIndex,
@@ -1095,17 +1173,17 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
if (!state.toolCallIdsSeen) state.toolCallIdsSeen = new Set();
if (callId) state.toolCallIdsSeen.add(callId);
- if (state.currentToolCallDeferred) {
- state.currentToolCallDeferred = false;
- state.currentToolCallArgsBuffer = "";
- state.currentToolCallId = null;
+ // This call is fully closed — remove it from the in-flight map (bounds the map
+ // to genuinely in-flight calls, and keeps the single-open-call fallback in the
+ // function_call_arguments.delta handler correct for whichever call opens next).
+ if (map && callId) map.delete(callId);
+ if (state.currentToolCallId === callId) state.currentToolCallId = null;
+ if (entry.deferred) {
if (!toolName) {
return null;
}
- state.toolCallIndex++;
-
const terminalArguments =
typeof item.arguments === "string"
? item.arguments.length > 0
@@ -1148,12 +1226,7 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
};
}
- state.toolCallIndex++;
- state.currentToolCallArgsBuffer = ""; // reset for next tool call
- state.currentToolCallId = null;
- const needsNormalization = state.currentToolCallNeedsNormalization === true;
- state.currentToolCallNeedsNormalization = false;
- state.currentToolCallName = "";
+ const needsNormalization = shouldNormalizeArguments;
// Nullable omission sentinels must be normalized before any argument bytes reach the client.
// Other tool calls retain immediate argument streaming.
diff --git a/open-sse/utils/streamHandler.ts b/open-sse/utils/streamHandler.ts
index 4d8993c7670e..9adb5dbf2f6e 100644
--- a/open-sse/utils/streamHandler.ts
+++ b/open-sse/utils/streamHandler.ts
@@ -683,13 +683,15 @@ export function createDisconnectAwareStream(transformStream, streamController) {
if (clientTerminalSeen) return;
terminalTail += terminalDecoder.decode(chunk, { stream: true });
- if (terminalTail.length > 4096) {
- terminalTail = terminalTail.slice(-4096);
- }
+ // Scan before bounding retained state: a compaction terminal frame can
+ // exceed the tail budget because encrypted_content is carried inline.
clientTerminalSeen = hasClientTerminalSseMarker(
terminalTail,
streamController.clientResponseFormat
);
+ if (terminalTail.length > 4096) {
+ terminalTail = terminalTail.slice(-4096);
+ }
if (clientTerminalSeen) {
streamController.markClientTerminalSeen?.();
}
diff --git a/open-sse/utils/streamPayloadCollector.ts b/open-sse/utils/streamPayloadCollector.ts
index 9ca089dfe4e3..31b9e818f46c 100644
--- a/open-sse/utils/streamPayloadCollector.ts
+++ b/open-sse/utils/streamPayloadCollector.ts
@@ -128,6 +128,75 @@ function tryParseJson(raw: string): unknown {
}
}
+/**
+ * Splits a tool_call `arguments` string that is actually multiple back-to-back JSON
+ * objects glued together with no separator, into its individual object substrings.
+ *
+ * Root cause (observed on opencode/muse-spark-1.2-contributor-free via the zen
+ * provider): some upstreams never vary `index`/`id` across a 2nd/3rd/… tool_call of
+ * the SAME name emitted in one turn, so every delta in `buildOpenAISummary` above
+ * resolves to the same accumulator key and `arguments` ends up as N JSON objects
+ * concatenated with no delimiter — invalid as a single JSON value, but each object is
+ * individually well-formed. Structural, not provider-specific: applies to whichever
+ * upstream exhibits the same index-collision streaming bug.
+ *
+ * Returns `null` when `raw` is empty, already valid single JSON, or does not scan as
+ * ≥2 back-to-back valid JSON values — callers must leave `arguments` untouched in
+ * that case (never regress a value that used to reach the client as-is).
+ */
+export function splitConcatenatedToolCallArguments(raw: string): string[] | null {
+ if (!raw) return null;
+ try {
+ JSON.parse(raw);
+ return null; // Already a single valid JSON value — nothing to split.
+ } catch {
+ // Fall through to the multi-value scan below.
+ }
+
+ const parts: string[] = [];
+ let depth = 0;
+ let inString = false;
+ let escaped = false;
+ let start = -1;
+
+ for (let i = 0; i < raw.length; i++) {
+ const ch = raw[i];
+ if (start === -1) {
+ if (ch === " " || ch === "\n" || ch === "\r" || ch === "\t") continue;
+ if (ch !== "{" && ch !== "[") return null; // Not a value boundary — bail, leave untouched.
+ start = i;
+ }
+ if (inString) {
+ if (escaped) escaped = false;
+ else if (ch === "\\") escaped = true;
+ else if (ch === '"') inString = false;
+ continue;
+ }
+ if (ch === '"') {
+ inString = true;
+ continue;
+ }
+ if (ch === "{" || ch === "[") depth++;
+ else if (ch === "}" || ch === "]") {
+ depth--;
+ if (depth === 0) {
+ parts.push(raw.slice(start, i + 1));
+ start = -1;
+ }
+ }
+ }
+ if (start !== -1 || depth !== 0 || parts.length < 2) return null;
+
+ for (const part of parts) {
+ try {
+ JSON.parse(part);
+ } catch {
+ return null; // One of the scanned segments isn't valid JSON — bail entirely.
+ }
+ }
+ return parts;
+}
+
// ─── Per-format live reducers ────────────────────────────────────────────────
// Each reducer mirrors the corresponding build*Summary()'s original for-loop
// body exactly (ingest = one loop iteration, finalize = the post-loop return),
@@ -262,7 +331,28 @@ function createOpenAIReducer(fallbackModel?: string | null): SummaryReducer {
message.reasoning_content = joinedReasoning;
}
- const finalToolCalls = [...toolCalls.values()].sort((a, b) => a.index - b.index);
+ const mergedToolCalls = [...toolCalls.values()].sort((a, b) => a.index - b.index);
+ // Expand any entry whose accumulated `arguments` turned out to be multiple
+ // concatenated JSON objects (upstream never varied index/id across repeated
+ // same-name tool_calls) into its own separate tool_calls entries.
+ const finalToolCalls: ToolCall[] = [];
+ let nextIndex = 0;
+ // Normalize tool_call indexes to contiguous 0-based (OpenAI contract).
+ for (const tc of mergedToolCalls) {
+ const splitArgs = splitConcatenatedToolCallArguments(tc.function.arguments);
+ if (!splitArgs) {
+ finalToolCalls.push({ ...tc, index: nextIndex++ });
+ continue;
+ }
+ for (const [i, args] of splitArgs.entries()) {
+ finalToolCalls.push({
+ id: tc.id ? `${tc.id}_split${i}` : null,
+ index: nextIndex++,
+ type: tc.type,
+ function: { name: tc.function.name, arguments: args },
+ });
+ }
+ }
if (finalToolCalls.length > 0) {
finishReason = "tool_calls";
message.tool_calls = finalToolCalls;
diff --git a/open-sse/utils/streamReadiness.ts b/open-sse/utils/streamReadiness.ts
index 2d06659b809b..1696a7a5c525 100644
--- a/open-sse/utils/streamReadiness.ts
+++ b/open-sse/utils/streamReadiness.ts
@@ -34,6 +34,14 @@ function hasUsefulValue(value: unknown): boolean {
if (Array.isArray(value)) return value.some(hasUsefulValue);
if (!isRecord(value)) return false;
+ // A Responses compaction item IS the turn's output: remote compaction
+ // completes with output = [{type:"compaction", encrypted_content}] and no
+ // assistant text. Deliberately NOT a blanket encrypted_content key — an
+ // encrypted reasoning item alone is not user-visible output and must keep
+ // tripping the #8649 empty-content guard.
+ // This shape is specific to Responses streams; chat-completion frames do not produce it.
+ if (value.type === "compaction" && hasNonEmptyString(value.encrypted_content)) return true;
+
for (const key of [
"content",
"text",
diff --git a/open-sse/utils/syncedEffortVariants.ts b/open-sse/utils/syncedEffortVariants.ts
index 2a2c7f0d68c2..33c5ec8c56ba 100644
--- a/open-sse/utils/syncedEffortVariants.ts
+++ b/open-sse/utils/syncedEffortVariants.ts
@@ -19,17 +19,17 @@
* only when the base model's own `supportedThinkingEfforts` actually declares that tier —
* never a blind string match.
*
- * Skipped entirely for `codex` and `kimi`-owned models: both already own a conflicting
- * native `-{effort}` suffix mechanism (`splitCodexReasoningSuffix` /
- * `getKimiCodeStaticThinkingPolicy`), so double-registering here would collide with their
- * own alias resolution. Also skipped for any model whose id already ends in a token that
- * matches a canonical effort value, to avoid colliding with a model that legitimately ends
- * in an effort-like token (e.g. a model literally named "...-high").
+ * Skipped entirely for `codex`, `kimi`-owned, and GLM (`glm`, `glm-cn`, `glmt`) models:
+ * they already own conflicting `-{effort}` aliases (`splitCodexReasoningSuffix`,
+ * `getKimiCodeStaticThinkingPolicy`, or `GlmExecutor::parseGlmEffortTier`), so generating
+ * another layer here would create invalid nested ids. Also skipped for any model whose id
+ * already ends in a token that matches a canonical effort value, to avoid colliding with a
+ * model that legitimately ends in an effort-like token (e.g. a model named "...-high").
*/
import { CANONICAL_EFFORT_VALUES } from "@/shared/reasoning/effortStandardization.ts";
-/** Provider ids that already own a native `-{effort}` suffix mechanism — never double-register. */
-export const SYNCED_EFFORT_SKIP_PROVIDERS = new Set(["codex"]);
+/** Provider ids with dedicated `-{effort}` aliases — never synthesize another suffix layer. */
+export const SYNCED_EFFORT_SKIP_PROVIDERS = new Set(["codex", "glm", "glm-cn", "glmt"]);
/** Provider-id prefixes covering that mechanism's multiple connection variants (kimi-coding, kimi-coding-apikey). */
const SYNCED_EFFORT_SKIP_PROVIDER_PREFIXES = ["kimi"];
diff --git a/package-lock.json b/package-lock.json
index 57f810910e73..bf77bab602a7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,7 +18,6 @@
"@dnd-kit/core": "^6.3.1",
"@dnd-kit/sortable": "^10.0.0",
"@dnd-kit/utilities": "^3.2.2",
- "@huggingface/transformers": "^4.2.0",
"@lobehub/icons": "^5.16.0",
"@modelcontextprotocol/sdk": "^1.29.0",
"@monaco-editor/react": "^4.7.0",
@@ -61,7 +60,6 @@
"next-themes": "^0.4.6",
"node-machine-id": "^1.1.12",
"omniglyph": "^1.4.0",
- "onnxruntime-node": "1.24.3",
"open": "^11.0.1",
"ora": "^9.4.1",
"parse5": "^8.0.1",
@@ -156,9 +154,11 @@
},
"optionalDependencies": {
"@atjsh/llmlingua-2": "3.0.0",
+ "@huggingface/transformers": "^4.2.0",
"better-sqlite3": "^13.0.2",
"js-tiktoken": "^1.0.20",
"keytar": "^7.9.0",
+ "onnxruntime-node": "1.24.3",
"sqlite-vec": "^0.1.9",
"tls-client-node": "^0.2.0",
"wreq-js": "^3.0.0"
@@ -4510,6 +4510,7 @@
"resolved": "https://registry.npmjs.org/@huggingface/jinja/-/jinja-0.5.9.tgz",
"integrity": "sha512-uWTG+l3VJRsl7EXxYizuL3P+cCPoc3cRqbWWRcQN0FhejRfbdq0RNhCmbY/YDtnTcz9icdLYuLDjsnz4d8JMuw==",
"license": "MIT",
+ "optional": true,
"engines": {
"node": ">=18"
}
@@ -4518,13 +4519,15 @@
"version": "0.1.3",
"resolved": "https://registry.npmjs.org/@huggingface/tokenizers/-/tokenizers-0.1.3.tgz",
"integrity": "sha512-8rF/RRT10u+kn7YuUbUg0OF30K8rjTc78aHpxT+qJ1uWSqxT1MHi8+9ltwYfkFYJzT/oS+qw3JVfHtNMGAdqyA==",
- "license": "Apache-2.0"
+ "license": "Apache-2.0",
+ "optional": true
},
"node_modules/@huggingface/transformers": {
"version": "4.2.0",
"resolved": "https://registry.npmjs.org/@huggingface/transformers/-/transformers-4.2.0.tgz",
"integrity": "sha512-8BRCoBMH0XsWaEIamuR0LrJGAfftgHAfb2Vrffy0VKlSAE/MnUJ5/h/zTfEP3fDIft+nk7TqB8xXEyABGitBjQ==",
"license": "Apache-2.0",
+ "optional": true,
"dependencies": {
"@huggingface/jinja": "^0.5.6",
"@huggingface/tokenizers": "^0.1.3",
@@ -9483,30 +9486,35 @@
"version": "1.1.2",
"resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
"integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
+ "devOptional": true,
"license": "BSD-3-Clause"
},
"node_modules/@protobufjs/base64": {
"version": "1.1.2",
"resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
"integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
+ "devOptional": true,
"license": "BSD-3-Clause"
},
"node_modules/@protobufjs/codegen": {
"version": "2.0.5",
"resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
"integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
+ "devOptional": true,
"license": "BSD-3-Clause"
},
"node_modules/@protobufjs/eventemitter": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz",
"integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
+ "devOptional": true,
"license": "BSD-3-Clause"
},
"node_modules/@protobufjs/fetch": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
"integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
+ "devOptional": true,
"license": "BSD-3-Clause",
"dependencies": {
"@protobufjs/aspromise": "^1.1.1"
@@ -9516,24 +9524,28 @@
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
"integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
+ "devOptional": true,
"license": "BSD-3-Clause"
},
"node_modules/@protobufjs/path": {
"version": "1.1.2",
"resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
"integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
+ "devOptional": true,
"license": "BSD-3-Clause"
},
"node_modules/@protobufjs/pool": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
"integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
+ "devOptional": true,
"license": "BSD-3-Clause"
},
"node_modules/@protobufjs/utf8": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.1.tgz",
"integrity": "sha512-oOAWABowe8EAbMyWKM0tYDKi8Yaox52D+HWZhAIJqQXbqe0xI/GV7FhLWqlEKreMkfDjshR5FKgi3mnle0h6Eg==",
+ "devOptional": true,
"license": "BSD-3-Clause"
},
"node_modules/@radix-ui/number": {
@@ -12737,6 +12749,7 @@
"version": "26.2.0",
"resolved": "https://registry.npmjs.org/@types/node/-/node-26.2.0.tgz",
"integrity": "sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==",
+ "devOptional": true,
"license": "MIT",
"dependencies": {
"undici-types": "~8.3.0"
@@ -13998,6 +14011,7 @@
"resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
"integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
"license": "MIT",
+ "optional": true,
"engines": {
"node": ">=14.0"
}
@@ -14971,7 +14985,8 @@
"resolved": "https://registry.npmjs.org/boolean/-/boolean-3.2.0.tgz",
"integrity": "sha512-d0II/GO9uf9lfUHH2BQsjxzRJZBdsjgsBiW4BvhWk/3qoKwQFjIDVN19PfX8F2D/r9PCMTtLWjYVCFrpeYUzsw==",
"deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
- "license": "MIT"
+ "license": "MIT",
+ "optional": true
},
"node_modules/bottleneck": {
"version": "2.19.5",
@@ -17935,6 +17950,7 @@
"version": "1.1.4",
"resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
"integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
+ "devOptional": true,
"license": "MIT",
"dependencies": {
"es-define-property": "^1.0.0",
@@ -17964,6 +17980,7 @@
"version": "1.2.1",
"resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.1.tgz",
"integrity": "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==",
+ "devOptional": true,
"license": "MIT",
"dependencies": {
"define-data-property": "^1.0.1",
@@ -18064,7 +18081,8 @@
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
"integrity": "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==",
- "license": "MIT"
+ "license": "MIT",
+ "optional": true
},
"node_modules/detect-node-es": {
"version": "1.1.0",
@@ -18908,7 +18926,8 @@
"version": "4.1.1",
"resolved": "https://registry.npmjs.org/es6-error/-/es6-error-4.1.1.tgz",
"integrity": "sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg==",
- "license": "MIT"
+ "license": "MIT",
+ "optional": true
},
"node_modules/es6-promisify": {
"version": "7.0.0",
@@ -20400,7 +20419,8 @@
"version": "25.9.23",
"resolved": "https://registry.npmjs.org/flatbuffers/-/flatbuffers-25.9.23.tgz",
"integrity": "sha512-MI1qs7Lo4Syw0EOzUl0xjs2lsoeqFku44KpngfIduHBYvzm8h2+7K8YMQh1JtVVVrUvhLpNwqVi4DERegUJhPQ==",
- "license": "Apache-2.0"
+ "license": "Apache-2.0",
+ "optional": true
},
"node_modules/flatted": {
"version": "3.4.2",
@@ -21226,6 +21246,7 @@
"resolved": "https://registry.npmjs.org/global-agent/-/global-agent-3.0.0.tgz",
"integrity": "sha512-PT6XReJ+D07JvGoxQMkT6qji/jVNfX/h364XHZOWeRzy64sSFr+xJ5OX7LI3b4MPQzdL4H8Y8M0xzPpsVMwA8Q==",
"license": "BSD-3-Clause",
+ "optional": true,
"dependencies": {
"boolean": "^3.0.1",
"es6-error": "^4.1.1",
@@ -21243,6 +21264,7 @@
"resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
"integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
"license": "ISC",
+ "optional": true,
"bin": {
"semver": "bin/semver.js"
},
@@ -21291,6 +21313,7 @@
"version": "1.0.4",
"resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.4.tgz",
"integrity": "sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==",
+ "devOptional": true,
"license": "MIT",
"dependencies": {
"define-properties": "^1.2.1",
@@ -21645,7 +21668,8 @@
"version": "1.0.9",
"resolved": "https://registry.npmjs.org/guid-typescript/-/guid-typescript-1.0.9.tgz",
"integrity": "sha512-Y8T4vYhEfwJOTbouREvG+3XDsjr8E3kIr7uf+JZ0BYloFsttiHU0WfvANVsR7TxNUJa/WpCnw/Ino/p+DeBhBQ==",
- "license": "ISC"
+ "license": "ISC",
+ "optional": true
},
"node_modules/hachure-fill": {
"version": "0.5.2",
@@ -21679,6 +21703,7 @@
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
"integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
+ "devOptional": true,
"license": "MIT",
"dependencies": {
"es-define-property": "^1.0.0"
@@ -24790,7 +24815,8 @@
"version": "5.0.1",
"resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
"integrity": "sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==",
- "license": "ISC"
+ "license": "ISC",
+ "optional": true
},
"node_modules/json5": {
"version": "2.2.3",
@@ -26654,6 +26680,7 @@
"resolved": "https://registry.npmjs.org/matcher/-/matcher-3.0.0.tgz",
"integrity": "sha512-OkeDaAZ/bQCxeFAozM55PKcKU0yJMPGifLwV4Qgjitu+5MoAfSQN4lsLJeXZ1b8w0x+/Emda6MZgXS1jvsapng==",
"license": "MIT",
+ "optional": true,
"dependencies": {
"escape-string-regexp": "^4.0.0"
},
@@ -29425,6 +29452,7 @@
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
"integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
+ "devOptional": true,
"license": "MIT",
"engines": {
"node": ">= 0.4"
@@ -29632,7 +29660,8 @@
"version": "1.24.3",
"resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.24.3.tgz",
"integrity": "sha512-GeuPZO6U/LBJXvwdaqHbuUmoXiEdeCjWi/EG7Y1HNnDwJYuk6WUbNXpF6luSUY8yASul3cmUlLGrCCL1ZgVXqA==",
- "license": "MIT"
+ "license": "MIT",
+ "optional": true
},
"node_modules/onnxruntime-node": {
"version": "1.24.3",
@@ -29640,6 +29669,7 @@
"integrity": "sha512-JH7+czbc8ALA819vlTgcV+Q214/+VjGeBHDjX81+ZCD0PCVCIFGFNtT0V4sXG/1JXypKPgScQcB3ij/hk3YnTg==",
"hasInstallScript": true,
"license": "MIT",
+ "optional": true,
"os": [
"win32",
"darwin",
@@ -29656,6 +29686,7 @@
"resolved": "https://registry.npmjs.org/onnxruntime-web/-/onnxruntime-web-1.26.0-dev.20260416-b7804b056c.tgz",
"integrity": "sha512-MD6Ss4GSpQBo6zqoJzyT9LRbKYs7x/JVN23FT24EcEvlqF4VuzPOeH6X38orZPKHQDbprn7K+SBpu0/mj2CQiw==",
"license": "MIT",
+ "optional": true,
"dependencies": {
"flatbuffers": "^25.1.24",
"guid-typescript": "^1.0.9",
@@ -29669,13 +29700,15 @@
"version": "5.3.2",
"resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
"integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
- "license": "Apache-2.0"
+ "license": "Apache-2.0",
+ "optional": true
},
"node_modules/onnxruntime-web/node_modules/onnxruntime-common": {
"version": "1.24.0-dev.20251116-b39e144322",
"resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.24.0-dev.20251116-b39e144322.tgz",
"integrity": "sha512-BOoomdHYmNRL5r4iQ4bMvsl2t0/hzVQ3OM3PHD0gxeXu1PmggqBv3puZicEUVOA3AtHHYmqZtjMj9FOfGrATTw==",
- "license": "MIT"
+ "license": "MIT",
+ "optional": true
},
"node_modules/open": {
"version": "11.0.1",
@@ -30906,7 +30939,8 @@
"version": "1.3.6",
"resolved": "https://registry.npmjs.org/platform/-/platform-1.3.6.tgz",
"integrity": "sha512-fnWVljUchTro6RiCFvCXBbNhJc2NijN7oIQxbwsyL0buWJPG85v81ehlHI9fXrJsMNgTofEoWIQeClKpgxFLrg==",
- "license": "MIT"
+ "license": "MIT",
+ "optional": true
},
"node_modules/playwright": {
"version": "1.62.1",
@@ -31861,6 +31895,7 @@
"version": "7.6.5",
"resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz",
"integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==",
+ "devOptional": true,
"hasInstallScript": true,
"license": "BSD-3-Clause",
"dependencies": {
@@ -31884,6 +31919,7 @@
"version": "5.3.2",
"resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
"integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
+ "devOptional": true,
"license": "Apache-2.0"
},
"node_modules/proxy-addr": {
@@ -33280,6 +33316,7 @@
"resolved": "https://registry.npmjs.org/roarr/-/roarr-2.15.4.tgz",
"integrity": "sha512-CHhPh+UNHD2GTXNYhPWLnU8ONHdI+5DI+4EYIAOaiD63rHeYlZvyh8P+in5999TTSFgUYuKUAjzRI4mdh/p+2A==",
"license": "BSD-3-Clause",
+ "optional": true,
"dependencies": {
"boolean": "^3.0.1",
"detect-node": "^2.0.4",
@@ -33655,7 +33692,8 @@
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/semver-compare/-/semver-compare-1.0.0.tgz",
"integrity": "sha512-YM3/ITh2MJ5MtzaM429anh+x2jiLVjqILF4m4oyQB18W7Ggea7BfqdH/wGMK7dDiMghv/6WG7znWMwUDzJiXow==",
- "license": "MIT"
+ "license": "MIT",
+ "optional": true
},
"node_modules/send": {
"version": "1.2.1",
@@ -33688,6 +33726,7 @@
"resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-7.0.1.tgz",
"integrity": "sha512-8I8TjW5KMOKsZQTvoxjuSIa7foAwPWGOts+6o7sgjz41/qMD9VQHEDxi6PBvK2l0MXUmqZyNpUK+T2tQaaElvw==",
"license": "MIT",
+ "optional": true,
"dependencies": {
"type-fest": "^0.13.1"
},
@@ -33703,6 +33742,7 @@
"resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.13.1.tgz",
"integrity": "sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg==",
"license": "(MIT OR CC0-1.0)",
+ "optional": true,
"engines": {
"node": ">=10"
},
@@ -34474,7 +34514,8 @@
"version": "1.1.3",
"resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
"integrity": "sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==",
- "license": "BSD-3-Clause"
+ "license": "BSD-3-Clause",
+ "optional": true
},
"node_modules/sql.js": {
"version": "1.14.2",
@@ -36187,6 +36228,7 @@
"version": "8.3.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
"integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+ "devOptional": true,
"license": "MIT"
},
"node_modules/unicode-emoji-modifier-base": {
diff --git a/package.json b/package.json
index bf2740f233a8..55cc574f9ecc 100644
--- a/package.json
+++ b/package.json
@@ -265,7 +265,6 @@
"@dnd-kit/core": "^6.3.1",
"@dnd-kit/sortable": "^10.0.0",
"@dnd-kit/utilities": "^3.2.2",
- "@huggingface/transformers": "^4.2.0",
"@lobehub/icons": "^5.16.0",
"@modelcontextprotocol/sdk": "^1.29.0",
"@monaco-editor/react": "^4.7.0",
@@ -308,7 +307,6 @@
"next-themes": "^0.4.6",
"node-machine-id": "^1.1.12",
"omniglyph": "^1.4.0",
- "onnxruntime-node": "1.24.3",
"open": "^11.0.1",
"ora": "^9.4.1",
"parse5": "^8.0.1",
@@ -343,9 +341,11 @@
},
"optionalDependencies": {
"@atjsh/llmlingua-2": "3.0.0",
+ "@huggingface/transformers": "^4.2.0",
"better-sqlite3": "^13.0.2",
"js-tiktoken": "^1.0.20",
"keytar": "^7.9.0",
+ "onnxruntime-node": "1.24.3",
"sqlite-vec": "^0.1.9",
"tls-client-node": "^0.2.0",
"wreq-js": "^3.0.0"
diff --git a/scripts/build/build-next-isolated.mjs b/scripts/build/build-next-isolated.mjs
index 37cd31a14acd..2a444174f18a 100644
--- a/scripts/build/build-next-isolated.mjs
+++ b/scripts/build/build-next-isolated.mjs
@@ -131,12 +131,12 @@ function runNextBuild() {
}
export function resolveNextBuildBundlerFlag(baseEnv = process.env) {
- // Turbopack is the default production bundler (Next 16 stable). Benchmarked on
- // this codebase: 2-3x faster than the single-threaded webpack pass (17min -> 9min
- // on a 32-core box; ~20min -> 7min on ubuntu-latest), artifact validated
- // end-to-end (standalone smoke + e2e/package/electron CI jobs). Webpack stays as
- // the explicit escape hatch (=0) for bundler-compat regressions.
- return baseEnv.OMNIROUTE_USE_TURBOPACK === "0" ? "--webpack" : "--turbopack";
+ // Turbopack is the default on Node.js; on Bun or when explicitly disabled (=0),
+ // use Webpack (--webpack) to avoid Turbopack V8 internal worker API mismatches.
+ if (process.versions.bun || baseEnv.OMNIROUTE_USE_TURBOPACK === "0") {
+ return "--webpack";
+ }
+ return "--turbopack";
}
/**
diff --git a/scripts/check/check-supported-node-runtime.ts b/scripts/check/check-supported-node-runtime.ts
index 197966822e97..f2b40e532699 100644
--- a/scripts/check/check-supported-node-runtime.ts
+++ b/scripts/check/check-supported-node-runtime.ts
@@ -15,6 +15,12 @@ if (!support.nodeCompatible) {
process.exit(1);
}
-console.log(
- `Node.js ${support.nodeVersion} satisfies OmniRoute secure runtime policy (${support.supportedRange}).`
-);
+if (process.versions.bun) {
+ console.log(
+ `Bun ${process.versions.bun} (${support.nodeVersion}) satisfies OmniRoute secure runtime policy.`
+ );
+} else {
+ console.log(
+ `Node.js ${support.nodeVersion} satisfies OmniRoute secure runtime policy (${support.supportedRange}).`
+ );
+}
diff --git a/scripts/dev/run-next.mjs b/scripts/dev/run-next.mjs
index 325398c2861e..e03cfc929030 100644
--- a/scripts/dev/run-next.mjs
+++ b/scripts/dev/run-next.mjs
@@ -83,8 +83,10 @@ const { dashboardPort } = runtimePorts;
const hostname = process.env.HOST || "0.0.0.0";
// Turbopack by default in dev (matches the Next 16 CLI default and the production
// build default in build-next-isolated.mjs); OMNIROUTE_USE_TURBOPACK=0 is the
-// webpack escape hatch.
-const useTurbopack = dev && mergedEnv.OMNIROUTE_USE_TURBOPACK !== "0";
+// webpack escape hatch. Under Bun, Turbopack native V8 bindings are unavailable,
+// so Bun automatically disables Turbopack and uses Webpack.
+const isBun = Boolean(process.versions.bun);
+const useTurbopack = dev && mergedEnv.OMNIROUTE_USE_TURBOPACK !== "0" && !isBun;
process.env.OMNIROUTE_WS_BRIDGE_SECRET ||= randomUUID();
// Per-process secret used to prove the trusted peer-IP stamp came from this
// server (read by the authz middleware in the same process). See peer-stamp.mjs.
diff --git a/skills/omni-webhooks/SKILL.md b/skills/omni-webhooks/SKILL.md
index 251b5f58176c..c60df46ecabe 100644
--- a/skills/omni-webhooks/SKILL.md
+++ b/skills/omni-webhooks/SKILL.md
@@ -1,12 +1,12 @@
---
name: omni-webhooks
-description: Register, list, test, and remove webhook endpoints. Configure event subscriptions (request.completed, provider.error, budget.exceeded, etc.) and manage delivery retries.
+description: Register, list, test, and remove webhook endpoints. Configure event subscriptions (request.completed, request.failed, quota.exceeded, etc.) and manage delivery retries.
---
## Overview
-Register, list, test, and remove webhook endpoints. Configure event subscriptions (request.completed, provider.error, budget.exceeded, etc.) and manage delivery retries.
+Register, list, test, and remove webhook endpoints. Configure event subscriptions (request.completed, request.failed, quota.exceeded, etc.) and manage delivery retries.
## Authentication
diff --git a/src/app/(dashboard)/dashboard/CheaperInferenceSponsorBanner.tsx b/src/app/(dashboard)/dashboard/CheaperInferenceSponsorBanner.tsx
new file mode 100644
index 000000000000..77cf19329833
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/CheaperInferenceSponsorBanner.tsx
@@ -0,0 +1,108 @@
+"use client";
+
+import { useSyncExternalStore } from "react";
+import { useTranslations } from "next-intl";
+import ProviderIcon from "@/shared/components/ProviderIcon";
+
+// Branded short link through our own link.omniroute.online shortener, so the
+// click lands in our Kutt metrics. Points at cheaperinference.com?utm_source=omniroute
+// (the URL in README.md's Open Source Friends section). Keep in sync with the
+// `cheaper` slug on the shortener.
+const CHEAPER_INFERENCE_URL = "https://link.omniroute.online/cheaper";
+
+// Cheaper Inference brand green (#31f889). White text on it fails contrast, so
+// the CTA pairs it with the dark ink from the provider's color token (colors.ts:
+// cheaperinference.text = #04170d). Hex values stay in sync with that token.
+
+const DISMISS_STORAGE_KEY = "omniroute-cheaperinference-sponsor-banner-dismissed-v1";
+// Same-tab signal for the dismiss button, since writing localStorage doesn't
+// fire a "storage" event in the tab that wrote it.
+const DISMISS_EVENT = "omniroute:cheaperinference-sponsor-banner-dismissed";
+
+function isNotDismissed(): boolean {
+ try {
+ return !localStorage.getItem(DISMISS_STORAGE_KEY);
+ } catch {
+ return true;
+ }
+}
+
+function subscribe(callback: () => void) {
+ window.addEventListener(DISMISS_EVENT, callback);
+ return () => window.removeEventListener(DISMISS_EVENT, callback);
+}
+
+// SSR has no localStorage, so the server always renders the banner visible;
+// useSyncExternalStore reconciles that against the real client-side value
+// right after hydration, mirroring KimiSponsorBanner's pattern.
+function getServerSnapshot() {
+ return true;
+}
+
+/**
+ * Dismissable banner announcing the Cheaper Inference OmniRoute partnership on
+ * the dashboard home page — same size/shape as KimiSponsorBanner, no version
+ * gate (durable partnership, not a time-boxed offer). The logomark reuses
+ *
+
+
+
+
{t("title")}
+
{t("description")}
+
+
+
+
+
+) {
+ if (typeof t?.has === "function" && t.has(key)) return t(key, values);
return fallback;
}
@@ -94,10 +99,9 @@ export default function IntelligentComboPanel({
const updatedCombo = await response.json();
onComboUpdated?.(updatedCombo);
notify.success(
- getI18nOrFallback(t, "modePackUpdated", "Mode pack updated to {pack}.").replace(
- "{pack}",
- modePackId
- )
+ getI18nOrFallback(t, "modePackUpdated", "Mode pack updated to {pack}.", {
+ pack: modePackId,
+ }).replace("{pack}", modePackId)
);
} catch (error: any) {
notify.error(error?.message || "Failed to update mode pack.");
@@ -184,10 +188,9 @@ export default function IntelligentComboPanel({
- {getI18nOrFallback(
- t,
- "reasoningTransportFallbackDropWarning",
- "May lose continuation context or cause tool-call continuations to fail."
- )}
-
- )}
+