Repository navigation
fix(db): union customModels with syncedAvailableModels in dispatch path - #12599
Closed
KooshaPari wants to merge 772 commits into
Closed
KooshaPari wants to merge 772 commits into
KooshaPari wants to merge 772 commits into
Conversation
Bumps [github.com/google/cel-go](https://github.com/google/cel-go) from 0.28.0 to 0.29.0. - [Release notes](https://github.com/google/cel-go/releases) - [Commits](google/cel-go@v0.28.0...v0.29.0) --- updated-dependencies: - dependency-name: github.com/google/cel-go dependency-version: 0.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: KooshaPari <koosha@omniroute.local>
…onflict resolution)
…steners-cap-2026-06-23'
Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8. - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) --- updated-dependencies: - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [qs](https://github.com/ljharb/qs) from 6.15.2 to 6.16.0. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) --- updated-dependencies: - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…uncation on cron re-trigger (W9.05) The cancel-in-progress: true pattern was killing the in-flight run when a 24h cron race re-triggered, which silently dropped the upload-artifact step (the report JSON/log never made it to the GH UI). Switched nightly-release-green.yml, nightly.yml, and auto-release.yml to cancel-in-progress: false so a previous run completes its artifact upload before the next one starts. Each fix carries a header comment pointing at the upstream-PR campaign (W10.03) — queue concurrency is an uncontroversial, issue-independent hygiene improvement, ideal for an early upstream PR.
…rufflehog secret-scan before npm publish (W9.06, W9.14) W9.06: infisical.yml and nightly-dispatch-bench.yml had no permissions: block, defaulting GITHUB_TOKEN to write-all. Both are read-only jobs so now correctly scoped to contents:read. W9.14: Added gitleaks:v8.21.2 + trufflehog:latest secret-scan to auto-release.yml npm publish path. Runs BEFORE any dist-tag gets written — a hard gate, not advisory. gitleaks covers generic high-entropy patterns; trufflehog adds provider-specific detector coverage (AWS/GCP/JWT/etc). Each returns exit 1 on a hit and the step aborts before the registry write.
… W1.13) W1.10 - bin/upstream-intel.mjs: Fetches all open issues + PRs from upstream (diegosouzapw/OmniRoute) and writes JSON snapshots + a markdown digest to ./upstream/. Supports --tier1 (fast-merge candidates) and --since=Nd filters. Designed to run daily via cron; output feeds the W10 upstream-PR factory. W1.13 - .github/workflows/fork-drift-warning.yml: Daily (14:00 UTC) check of commit distance from upstream/main. Opens a soft GH issue warning at >=10 commits ahead, a critical warning at >=25. Never blocks - warning only. Respects the rebase cadence in UPSTREAM.md.
… (W2.x, fixes cheaper-inference#12084 CVE-2025-68121) The bogdanfinn/tls-client native binary was being silently locked to v1.15.1 because the postinstall short-circuits at 'binary already exists' when the .so/.dylib is cached on a multi-stage build. v1.15.1 ships with Go stdlib 1.24.1, which carries CVE-2025-68121 (CRITICAL per Trivy). Upstream shipped v1.16.0 on 2026-09-02 (Go stdlib 1.24.7) but the fork never picked it up because the cache short-circuit masked the update. This change: 1. Adds TLS_CLIENT_VERSION ARG (default 1.16.0) to the Dockerfile so the postinstall fetches a deliberate, auditable version rather than 'latest' (which is itself a reproducibility problem). 2. Deletes any cached .so/.dylib from a prior build before invoking postinstall, so the short-circuit never masks an update. 3. Verifies the downloaded asset's filename contains the requested version string, failing the build loudly if the asset wasn't found (Trivy gate stays green). This is upstream-portable — the fix is minimal, self-contained, and addresses an acknowledged security issue. PR candidate for issue cheaper-inference#12084 in the W10 upstream-PR campaign.
…est + tracker (W10.01, W10.02, W10.07) bin/pr-candidates.mjs (W10.07): - --status : show live queue sorted by merge-odds (B1→B8) - --update : re-run upstream-intel.mjs and refresh queue - --summary : one-liner for scripting (281 issues, 6 tier1, 38 acked currently) - --claim N : show plan-first instructions before drafting - --draft N : preview PR body + branch name for a given issue upstream/pr-candidates.md: - Canonical queue table — Tier 1 (claim immediately) through Tier 4 - All 15 most-tractable upstream issues with effort/merge-odds/status - Claim rules, queue discipline, and upstream PR metadata upstream/digest.md: - Live daily digest produced by upstream-intel.mjs - Tier-1 summary + top-10 recent issues + top-15 open PRs - Automatically overwritten on every run; gitignored This is the operational backbone of the W10 upstream-PR campaign.
…eaper-inference#12272 partial) The i18n:sync-ui run in cheaper-inference#12261 produced a __MISSING__: sentinel for keys that did not exist in en.json. Those 17 keys have been sitting in 40+ locale catalogs as broken placeholders since the sync shipped. i18n:check only flags them as 'in en', so the build went green; only i18n:strict-ui (which we never wired in CI, see cheaper-inference#12560) would have caught them. This change adds the source-of-truth EN values extracted from the __MISSING__ markers themselves. Once en.json has the keys, the existing i18n:sync-ui flow can backfill real translations across the 42 locales that previously rendered the English fallback verbatim. Added keys (17 total): featureFlags.ccDiscoveryAliasesEnvWarning settings.compressionExclusionsTitle / Desc / Placeholder / Save / Saved / Count / Empty oauthModal.googleLoopbackTitle / WhatHappens / Recommended / HelperNote / TunnelLabel / TunnelNote / HeadlessAlt providers.antigravityClientProfileHarness settings.resetUsageDataDesc bin/i18n-audit.mjs (W2.x): Live audit of all 43 locale catalogs. Reports distinct missing keys, per-locale count, and split between 'truly-missing-from-en' (need a source) and 'translated-but-stale' (have source, locale has stale __MISSING__). --fix emits upstream/i18n-fix-plan.json. Audit before: 17 truly-missing + 554 translated-but-stale = 571 distinct keys across 43 locales, 8,372 occurrences. Audit after: 0 truly-missing + 571 translated-but-stale = 571 distinct keys across 43 locales, 8,355 occurrences (17 fixed). PR candidate for upstream cheaper-inference#12272.
… CVE gate W9.04 — bin/pin-actions.mjs + 40 workflow files rewritten: 121 floating version-tag pins (@v4/@v6/@v7) replaced with pinned commit SHAs across all .github/workflows/ — eliminates a full class of 'action version drift' breakage. Script is idempotent and re-runnable (only rewrites lines that still match the floating tag pattern). W9.08 — SLSA L3 build provenance attestation added to: npm-publish.yml: actions/attest-build-provenance on @kooshapari/omniroute docker-publish.yml: same on ghcr.io/kooshapari/omniroute Both push-to-registry: true so provenance travels with the artifact. Consumers: gh attestation verify <ref> W9.10 — CVE >= 7 hard gate on the npm tarball before registry write: scripts/ci/cve-gate.sh queries OSV.dev API against every SBOM component and exits 2 if any component has CVSS >= threshold. Integrated into the npm-publish.yml publish job — runs before 'npm stage publish', never after. Threshold is configurable per invocation (default 7 = HIGH+).
….15) scripts/ci/docker-smoke.sh: Boots a candidate image, resolves the published port (3000), hits /healthz once immediately then holds for 5s stability window, checks container is still 'Running' at exit. Exits 0 only if: HTTP 200 probe + stays up for 5s + no crash. Used by both docker-publish.yml (per-tag, pre-provenance) and auto-release.yml (per-channel publish). auto-release.yml publish-docker job: Smoke test added AFTER docker build+push and BEFORE the summary job — so a boot failure red-lines the run before 'Docker publish: success'. docker-publish.yml merge job: Smoke test added AFTER inspect and BEFORE attest-build-provenance — so a bad image never gets an SLSA attestation.
…rkflow
W9.19 — .github/workflows/release-drafter-dryrun.yml:
Runs release-drafter --dry-run on every PR open/sync. If the template has
a syntax error or a label produces a broken changelog, the step fails BEFORE
any release ships — catches template drift early.
W9.25 — docs/operations/RELEASE_ROLLBACK.md + release-rollback.yml:
docs/operations/RELEASE_ROLLBACK.md:
Full 30-min RTO playbook: Path A (npm + Docker + GH Release rollback),
Path B (hotfix), Path C (feature-flag). Includes triage table, the
signal→decision matrix, verification steps, and postmortem requirements.
.github/workflows/release-rollback.yml:
One-click Path A. Inputs: broken_version, good_version, good_digest_base,
confirm='ROLLBACK' interlock. Never publishes — only repoints dist-tags
and re-tags :latest to a known-good digest. Opens an incident issue on
completion.
…ssify-commit W1.12 — UPSTREAM.md divergence policy: Covers: (1) when to rebase vs merge vs fast-forward, (2) what PR-target labels mean (draft/candidate/strategic), (3) how to queue upstream PRs by priority, (4) divergence budget (10 commits / 5 files / 1 major feature break), (5) what constitutes a blocking change vs a candidate change, (6) the PR-first protocol for upstream, (7) fork identity vs upstream identity in CI, (8) the rebase cadence schedule. W1.18 — upstream/divergence-manifest.json + upstream/divergence-summary.md: Machine-readable manifest of all 26 fork-vs-upstream commits with W-class classification, files touched, PR-target label, and rebase-conflict risk. Summary groups by portable/fork-only/blocking and sorts by pr-risk asc. W1.19 — bin/classify-commit.mjs: Tags any commit with a W-class trailer: P (portable), F (fork-only), B (blocking). Adds to commit message body as 'W-class: X' and to a git-notes ref (refs/notes/wclass) so the manifest can read it back. Usage: node bin/classify-commit.mjs <sha> P|F|B [--force]
W2.1 - bf65512: retry/quota recovery follow-ups (B4 acked) W2.2 - 6da8329: restore provider/validation APIs (B4 acked) W2.3 - a0ebfab: remove duplicate defs in perplexity-web.ts (B4 acked) W2.4 - 321a894: close missing braces/parens (B3 trivial) W2.5 - 79d5bf2: bump browserslist 4.28.2 -> 4.28.7 (B2 deps) bin/divergence-manifest.mjs: now reads pr-target from refs/notes/prtarget (avoids rewriting commit history to tag PRs). upstream/w2-pr-candidates.md: the operational guide for opening these.
…ity, upstream PR templates
W3 — upstream-feature-catalog.mjs + w3-feature-catalog.json:
5 candidate upstream PRs: OpenAI Responses WS proxy, Cohere provider,
fast JSON-schema validator, gRPC server, MCP tool-use loop.
W3.1 is 70% done in the fork already.
W4 — docs/wbs/w4-performance.md:
5 items: undici keep-alive pooling, LRU auth cache, streaming JSON
parsing, dependency audit/removal, cold-start reduction.
W5 — docs/wbs/w5-dx-tooling.md:
7 items: commitlint, husky, prettier+eslint, tsconfig hardening,
ARCHITECTURE.md, CONTRIBUTING.md, vitest watch-mode default.
W6 — docs/wbs/w6-deployment.md:
7 items: multi-stage Dockerfile, docker-compose, auto-deploy on tag,
SBOM generation, cosign signing, Prometheus metrics, OpenTelemetry.
W7 — docs/wbs/w7-polish.md:
5 items: design tokens, dark mode, OpenAPI reference, quickstart guide,
README refresh.
W8 — docs/wbs/w8-community.md:
5 items: scoped npm package, blog post, plugin directory, sponsor button,
community Discord.
W10 — remaining items:
pull_request_template_upstream.md: the upstream PR template for all
upstream submissions (W10.07 companion)
docs/wbs/w10.15-sponsor.md: the sponsorship action item (/mo diegosouzapw)
docs/wbs/w10.19-quarterly-post.md: quarterly contribution post template
(LinkedIn/Hashnode, scheduled for Q3-Q4 2026)
…orepo The standalone KooshaPari/homebrew-omniroute tap is now folded into the monorepo at packaging/homebrew/. The formula's homepage is updated to point at the canonical OmniRoute repo. A README in packaging/homebrew/ documents the install path and bump procedure. Decision (per session 2026-09-03 with operator Koosha): keep the distribution formula in-tree rather than as a separate repo, so the formula version tracks the release it describes. Provenance: see repos/.archive/2026-09-03-monorepo-consolidation/README.md koosha-phenotype/docs/omniroute-integration/INTEGRATION_MANIFEST.md
Follow-up to the merge of the homebrew tap into the monorepo. The local archive directory was renamed from repos/.archive/ to repos/zz-archive/ per the zz- prepend convention; update the provenance pointer in the homebrew packaging README.
Contributor
Author
|
Closing per H-C plan (retracting DB dispatch fix that depends on schema migrations not yet in upstream). Will re-cherry-pick after Ravi thread resolves or when upstream merges the migration PRs this depends on. PR pairs with #12614 (i18n), #12612 (CVE), #12592 (deps), #12586 (braces), #12470 (backfill), #12667 (docs) which remain open. Refs: WAITING-handoff 2026-09-03. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
getActiveProvidersWithSyncedModelinsrc/lib/db/models.tsonly reads fromkey_value(namespace='syncedAvailableModels')and ignoreskey_value(namespace='customModels'), so models added through the provider dashboard's "model picker" are written to one store but read from another. Chat dispatch then returnsModel '…' is not available in the active live catalog for provider '…'for perfectly valid models that the user just successfully added.Motivation
We hit this while moving 64 sub-agents × 16 chats to a
Maincombo that referencesnvidia/deepseek-ai/deepseek-v4-pro-0813. The model is fully in the live catalog (verified viaGET /api/providers/nvidia/models) and is added to combos via the dashboard model picker, yet the dispatch path returns400 invalid_request_errorand excludes the provider withterminalReason: Model 'deepseek-ai/deepseek-v4-pro-0813' is not available in the active live catalog for provider 'nvidia'. The only workaround is to re-runPOST /api/providers/{id}/sync-models, which rewritessyncedAvailableModelsfrom the upstream catalog — but that is destructive (it dropped 78 non-free models the first time we ran it) and is not what the user did.Steps to reproduce:
key_value(namespace='customModels'))provider/model)Model '…' is not available in the active live catalogeven though the model is in the live catalogRelated: #12298 (stale dashboard data), #12168 (provider "unhealthy" status bugs), #12073, #11804.
Proposed Fix
In
src/lib/db/models.ts:528-552(getActiveProvidersWithSyncedModeland its callers), union thecustomModelsnamespace withsyncedAvailableModelswhen building the per-provider live model set. Specifically:The dashboard write path (
useProviderModels.ts,managedModelImport.ts,POST /api/provider-models) already keepscustomModelsaccurate, so no write-side changes are needed.Optional follow-up: surface
customModelsseparately in the dashboard so users can see why a model is in scope (e.g. "pinned" vs "discovered via sync"), and add a "resync" button that does not drop pinned models.Testing
Checklist
bun test src/lib/db/models.test.tspasses (will need new test covering the merge)npm run lintpassesfix(db): union customModels with syncedAvailableModels in dispatch pathDiff characteristics
getActiveProvidersWithSyncedModelmodels.test.ts(one for union, one for precedence)