fix(reasoning): preserve mixed plaintext and drop incompatible state (#10949, #10959)

.env.example

@@ -87,6 +87,10 @@ DISABLE_SQLITE_AUTO_BACKUP=false
 # Used by: src/shared/utils/rateLimiter.ts
 # Example: redis://localhost:6379 (or redis://redis:6379 in Docker)
 # REDIS_URL=redis://localhost:6379
+# Namespace prefix for ALL OmniRoute Redis keys (rate limiter + auth cache +
+# quota store). Prevents key collisions when OmniRoute shares a Redis instance
+# with other apps (e.g. on 127.0.0.1:6379). Default when unset: omniroute:
+# REDIS_KEY_PREFIX=omniroute:
 # Host interface docker-compose publishes the Redis sidecar on.
 # Default: 127.0.0.1 (loopback only). The compose Redis runs WITHOUT
 # `requirepass`, and app containers reach it over the compose network
@@ -372,9 +376,8 @@ ALLOW_API_KEY_REVEAL=false
 # NO_LOG_API_KEY_IDS=key_abc123,key_def456
 
 # Fallback per-day request budget applied to API keys whose `rate_limits`
-# column is null. Default (unset/empty/malformed) preserves the legacy
-# 1000/day, 5000/week, 20000/month windows so existing deployments do not
-# silently lose rate limiting on upgrade.
+# column is null. Default (unset/empty) is unlimited (no implicit caps).
+# Malformed values preserve the legacy 1000/day, 5000/week, 20000/month windows.
 # Set explicitly to "0" to opt out entirely (unlimited fallback). Any
 # positive integer N enables N/day, 5N/week, 20N/month.
 # Used by: src/shared/utils/apiKeyPolicy.ts — checkRateLimit() fallback.

.github/workflows/dast-smoke.yml

@@ -46,6 +46,7 @@ jobs:
         env:
           PORT: "20128"
           INJECTION_GUARD_MODE: block
+          REQUIRE_API_KEY: "false"
         run: |
           node dist/server.js > server.log 2>&1 &
           echo $! > server.pid
@@ -64,16 +65,20 @@ jobs:
           # those 302s as "the API accepted a schema-violating request" and the configured-off
           # 400 as "rejected a schema-compliant request". Documenting the flow in the spec is
           # still right (operators need it); fuzzing it is not what this smoke is for.
+          # /api/auth/login has brute-force rate limiting: repeated failed logins return 429,
+          # which Schemathesis flags as rejection of schema-compliant requests.
           schemathesis run docs/openapi.yaml --url http://localhost:20128 \
             --include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
-            --exclude-path-regex '^/api/auth/oidc/' \
+            --exclude-path-regex '^/api/auth/(oidc/|login)' \
             --max-examples 8 --workers 4 --checks all --max-response-time 30 \
             --request-timeout 20 --suppress-health-check all --no-color
+      - name: Install promptfoo
+        run: npm install -g promptfoo@0.122.0
       - name: promptfoo injection-guard (blocking)
         env:
           OMNIROUTE_URL: http://localhost:20128
           OMNIROUTE_API_KEY: not-needed-blocked-before-upstream
-        run: npx --yes promptfoo@latest eval -c promptfooconfig.yaml --no-cache
+        run: promptfoo eval -c promptfooconfig.yaml --no-cache
       - name: Stop server
         if: always()
         run: kill "$(cat server.pid)" || true

.github/workflows/docker-publish.yml

@@ -183,15 +183,55 @@ jobs:
         env:
           DOCKER_BUILDKIT_INLINE_CACHE: 1
 
+      - name: Build and push BUN base platform image by digest
+        id: build-bun-base
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        with:
+          context: .
+          file: Dockerfile.bun
+          target: runner-base
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
+          tags: |
+            ${{ env.IMAGE_NAME }}
+            ${{ env.GHCR_IMAGE_NAME }}
+          cache-from: type=gha,scope=docker-bun-base-${{ matrix.arch }}
+          cache-to: type=gha,scope=docker-bun-base-${{ matrix.arch }},mode=max
+          no-cache: false
+        env:
+          DOCKER_BUILDKIT_INLINE_CACHE: 1
+
+      - name: Build and push BUN web platform image by digest
+        id: build-bun-web
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        with:
+          context: .
+          file: Dockerfile.bun
+          target: runner-web
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
+          tags: |
+            ${{ env.IMAGE_NAME }}
+            ${{ env.GHCR_IMAGE_NAME }}
+          cache-from: type=gha,scope=docker-bun-web-${{ matrix.arch }}
+          cache-to: type=gha,scope=docker-bun-web-${{ matrix.arch }},mode=max
+          no-cache: false
+        env:
+          DOCKER_BUILDKIT_INLINE_CACHE: 1
+
       - name: Export digests
         env:
           DIGEST_BASE: ${{ steps.build.outputs.digest }}
           DIGEST_WEB: ${{ steps.build-web.outputs.digest }}
+          DIGEST_BUN_BASE: ${{ steps.build-bun-base.outputs.digest }}
+          DIGEST_BUN_WEB: ${{ steps.build-bun-web.outputs.digest }}
         run: |
           set -euo pipefail
-          mkdir -p /tmp/digests/base /tmp/digests/web
+          mkdir -p /tmp/digests/base /tmp/digests/web /tmp/digests/bun-base /tmp/digests/bun-web
           touch "/tmp/digests/base/${DIGEST_BASE#sha256:}"
           touch "/tmp/digests/web/${DIGEST_WEB#sha256:}"
+          touch "/tmp/digests/bun-base/${DIGEST_BUN_BASE#sha256:}"
+          touch "/tmp/digests/bun-web/${DIGEST_BUN_WEB#sha256:}"
 
       - name: Upload base digests
         uses: actions/upload-artifact@v7
@@ -209,6 +249,22 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+      - name: Upload bun-base digests
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: digests-bun-base-${{ matrix.arch }}
+          path: /tmp/digests/bun-base/*
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Upload bun-web digests
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: digests-bun-web-${{ matrix.arch }}
+          path: /tmp/digests/bun-web/*
+          if-no-files-found: error
+          retention-days: 1
+
   merge:
     name: Publish multi-arch manifests
     needs:
@@ -263,6 +319,20 @@ jobs:
           path: /tmp/digests/web
           merge-multiple: true
 
+      - name: Download bun-base digests
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          pattern: digests-bun-base-*
+          path: /tmp/digests/bun-base
+          merge-multiple: true
+
+      - name: Download bun-web digests
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          pattern: digests-bun-web-*
+          path: /tmp/digests/bun-web
+          merge-multiple: true
+
       - name: Create Docker Hub manifest
         run: |
           set -euo pipefail
@@ -286,6 +356,8 @@ jobs:
 
           create_manifest "${IMAGE_NAME}" "" /tmp/digests/base
           create_manifest "${IMAGE_NAME}" "-web" /tmp/digests/web
+          create_manifest "${IMAGE_NAME}" "-bun" /tmp/digests/bun-base
+          create_manifest "${IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web
 
       - name: Create GHCR manifest
         run: |
@@ -310,6 +382,8 @@ jobs:
 
           create_manifest "${GHCR_IMAGE_NAME}" "" /tmp/digests/base
           create_manifest "${GHCR_IMAGE_NAME}" "-web" /tmp/digests/web
+          create_manifest "${GHCR_IMAGE_NAME}" "-bun" /tmp/digests/bun-base
+          create_manifest "${GHCR_IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web
 
       - name: Inspect image
         if: needs.prepare.outputs.version != 'main'

AGENTS.md

@@ -56,7 +56,7 @@ Repository map and Reference Documentation sections below.
 | Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                                                  |
 | Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                                          |
 | Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                                  |
-| Database      | `src/lib/db/`           | SQLite domain modules (157 migrations)                                                                                                                                    |
+| Database      | `src/lib/db/`           | SQLite domain modules (159 migrations)                                                                                                                                    |
 | Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                                                 |
 | MCP Server    | `open-sse/mcp-server/`  | 110 tools (44 canonical + memory/skill/GitHub/pool/gamification/plugin/Notion/Obsidian/local-corpus/RTK modules), 3 transports (stdio / SSE / Streamable HTTP), 33 scopes |
 | A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                                               |

Dockerfile.bun

@@ -0,0 +1,146 @@
+# ── Multi-stage Dockerfile for Native Bun Runtime (web-latest-bun) ───────────
+FROM oven/bun:1.3.14-slim AS base
+WORKDIR /app
+
+RUN apt-get update \
+  && apt-get upgrade -y \
+  && apt-get install -y --no-install-recommends \
+     build-essential \
+     python3 \
+     python-is-python3 \
+     make \
+     g++ \
+     libsecret-1-0 \
+     ca-certificates \
+     curl \
+  && rm -rf /var/lib/apt/lists/*
+
+# ── Builder stage (100% Bun Native Install & Build) ─────────────────────────
+FROM base AS builder
+WORKDIR /app
+
+COPY . .
+
+# Fast Bun native package install
+RUN bun install --include=optional --quiet
+
+# Compile native better-sqlite3 Node-API addon under Bun
+RUN if [ -d "node_modules/better-sqlite3" ]; then \
+      (cd node_modules/better-sqlite3 && bunx node-gyp rebuild); \
+    fi
+
+# Fetch tls-client-node native binary if script exists
+RUN if [ -f "node_modules/tls-client-node/scripts/postinstall.js" ]; then \
+      bun node_modules/tls-client-node/scripts/postinstall.js || true; \
+    fi
+
+# Disable Turbopack for Bun builder stage (Turbopack V8 internal worker bindings require Node)
+ENV OMNIROUTE_USE_TURBOPACK=0
+
+ARG OMNIROUTE_BASE_PATH=""
+ENV OMNIROUTE_BASE_PATH=$OMNIROUTE_BASE_PATH
+
+ARG DASHBOARD_ALLOW_EMBED=""
+ENV DASHBOARD_ALLOW_EMBED=$DASHBOARD_ALLOW_EMBED
+
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV NODE_ENV=production
+
+# Bun native Next.js build execution
+RUN bun run --quiet build
+
+# ── Runner Base stage (100% Bun Native Production Runtime) ──────────────────
+FROM oven/bun:1.3.14-slim AS runner-base
+
+LABEL org.opencontainers.image.title="omniroute" \
+  org.opencontainers.image.description="Unified AI proxy — route any LLM through one endpoint (Bun Native)" \
+  org.opencontainers.image.url="https://omniroute.online" \
+  org.opencontainers.image.source="https://github.com/diegosouzapw/OmniRoute" \
+  org.opencontainers.image.licenses="MIT"
+
+WORKDIR /app
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+     libsecret-1-0 \
+     ca-certificates \
+     curl \
+  && rm -rf /var/lib/apt/lists/*
+
+ENV NODE_ENV=production
+ENV PORT=20128
+ENV HOSTNAME=0.0.0.0
+ENV OMNIROUTE_MEMORY_MB=1024
+
+ENV DATA_DIR=/app/data
+RUN mkdir -p /app/data
+
+COPY --from=builder /app/.build/next/standalone ./
+COPY --from=builder /app/node_modules/better-sqlite3 ./node_modules/better-sqlite3
+ENV OMNIROUTE_MIGRATIONS_DIR=/app/migrations
+
+COPY --from=builder /app/scripts/dev/healthcheck.mjs ./healthcheck.mjs
+
+EXPOSE 20128
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD bun healthcheck.mjs || exit 1
+
+ENTRYPOINT ["bun", "dev/run-standalone.mjs"]
+
+# ── Runner Web stage (Bun Native + Chromium/Playwright for Web providers) ───
+FROM runner-base AS runner-web
+
+USER root
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+     chromium \
+     chromium-driver \
+     fonts-liberation \
+     libasound2t64 \
+     gconf-service \
+     libatk-bridge2.0-0 \
+     libatk1.0-0 \
+     libc6 \
+     libcairo2 \
+     libcups2 \
+     libdbus-1-3 \
+     libexpat1 \
+     libfontconfig1 \
+     libgbm1 \
+     libgcc-s1 \
+     libglib2.0-0 \
+     libgtk-3-0 \
+     libnspr4 \
+     libnss3 \
+     libpango-1.0-0 \
+     pangocairo-1.0-0 \
+     stdc++6 \
+     libx11-6 \
+     libx11-xcb1 \
+     libxcb1 \
+     libxcomposite1 \
+     libxcursor1 \
+     libxdamage1 \
+     libxext6 \
+     libxfixes3 \
+     libxi6 \
+     libxrandr2 \
+     libxrender1 \
+     libxss1 \
+     libxtst6 \
+     ca-certificates \
+     fonts-gargi \
+     fonts-ipafont-gothic \
+     fonts-kacst \
+     fonts-thai-tlwg \
+     fonts-wqy-zenhei \
+  && rm -rf /var/lib/apt/lists/*
+
+ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
+ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
+
+# Return to the base image non-root user after the apt install (mirrors the
+# Node Dockerfile runner-web stage, which re-asserts USER node).
+USER bun

README.md

@@ -210,7 +210,7 @@ curl http://localhost:20128/v1/chat/completions \
 
 </div>
 
-<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint. 348 providers. Never stop building — OmniRoute picks the cheapest one that works. Six pillars: Never hit limits (auto-fallback across 348 providers in milliseconds, zero downtime) · Save up to 95% tokens (RTK + Caveman stacked compression cuts 15–95%, ~89% avg on tool-heavy sessions) · $0 to start (90+ free tiers, 57 free forever — no card needed) · Every tool works (33 coding agents through one config) · One endpoint (OpenAI ↔ Claude ↔ Gemini ↔ Responses API at /v1) · Production-grade (circuit breakers, TLS stealth, MCP 110 tools, A2A, memory, guardrails, evals — 25,000+ tests)."/>
+<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint. 348 providers. Never stop building — OmniRoute picks the cheapest one that works. Six pillars: Never hit limits (auto-fallback across 348 providers in milliseconds, zero downtime) · Save up to 95% tokens (RTK + Caveman stacked compression cuts 15–95%, ~89% avg on tool-heavy sessions) · $0 to start (90+ free tiers, 56 free forever — no card needed) · Every tool works (33 coding agents through one config) · One endpoint (OpenAI ↔ Claude ↔ Gemini ↔ Responses API at /v1) · Production-grade (circuit breakers, TLS stealth, MCP 110 tools, A2A, memory, guardrails, evals — 25,000+ tests)."/>
 
 <br/>
 <br/>
@@ -646,7 +646,7 @@ of your shell history. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
 
 </div>
 
-> The most complete catalog of any open-source router: **348 providers**, **90+ with a free tier**, **57 free forever**.
+> The most complete catalog of any open-source router: **348 providers**, **90+ with a free tier**, **56 free forever**.
 
 <div align="center">
 
@@ -1009,6 +1009,19 @@ Full table: [Docker Guide — runtime RAM](docs/guides/DOCKER_GUIDE.md#runtime-r
 > are **not supported for production**. See
 > [Docker Release Channels](docs/guides/DOCKER_GUIDE.md#release-channels).
 
+**🥟 Bun**
+
+Standard `bun install` and global installation (`bun install -g omniroute`) are supported via Bun runtime detection:
+- **Built-in `bun:sqlite`**: OmniRoute uses Bun's built-in `bun:sqlite` driver when running under Bun, falling back to `better-sqlite3` on Node.js or `sql.js`.
+- **Automatic Webpack bundler selection**: Development (`bun run dev`) and production builds (`bun run build`) automatically detect Bun and disable Turbopack in favor of Webpack to prevent native V8 binding incompatibilities.
+- **Dedicated Bun Dockerfile**: Multi-stage `Dockerfile.bun` for native Bun production deployments (`docker build -f Dockerfile.bun -t omniroute:bun .`).
+
+```bash
+# Install and run with Bun
+bun install
+bun run dev
+```
+
 **🛠️ From source**
 
 ```bash
@@ -1187,7 +1200,7 @@ Métricas de validação: 1002 vídeos rastreados · 7,069,190 visualizações c
   <tr><td nowrap><b>Runtime</b></td><td>Node.js 22.x / 24.x LTS — <code>&gt;=22.22.2 &lt;23 || &gt;=24.0.0 &lt;27</code></td></tr>
   <tr><td nowrap><b>Language</b></td><td>TypeScript 6.0 — <b>100% TypeScript</b> across <code>src/</code> and <code>open-sse/</code> (zero <code>any</code> in core since v2.0)</td></tr>
   <tr><td nowrap><b>Framework</b></td><td>Next.js 16 + React 19 + Tailwind CSS 4</td></tr>
-  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 120 domain modules, 157 migrations</td></tr>
+  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 120 domain modules, 159 migrations</td></tr>
   <tr><td nowrap><b>Memory</b></td><td>SQLite FTS5 full-text + int8-quantized vector embeddings, typed decay</td></tr>
   <tr><td nowrap><b>Schemas</b></td><td>Zod 4 — MCP tool I/O validation + API contracts</td></tr>
   <tr><td nowrap><b>Protocols</b></td><td>MCP (stdio / HTTP / SSE) + A2A v0.3 (JSON-RPC 2.0 + SSE)</td></tr>

bin/cli/commands/combo.mjs

@@ -307,6 +307,12 @@ export async function runComboCreateCommand(name, strategy = "priority", opts =
   }
 
   const models = Array.isArray(opts.models) ? opts.models : [];
+  if (!models.length) {
+    console.error(
+      "combo create requires at least one target. Pass --models <provider/model,...> and/or repeat --model <provider/model>."
+    );
+    return 1;
+  }
 
   try {
     return await withRuntime(async ({ kind, api, db }) => {