Skip to content

feat(skills): provider-aware marketplace UX, scored AUTO injection, and memory pipeline hardening - #1411

Closed
oyi77 wants to merge 5 commits into
cheaper-inference:release/v3.6.9from
oyi77:investigation/skills-provider-memory-3.6.9
Closed

oyi77 wants to merge 5 commits into
cheaper-inference:release/v3.6.9from
oyi77:investigation/skills-provider-memory-3.6.9

Conversation

@oyi77

@oyi77 oyi77 commented Apr 19, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR completes and validates the 3.6.9 skills+memory investigation track by shipping provider-aware skills behavior end-to-end (backend + dashboard), improving AUTO injection quality, and fixing a runtime/dev blocker discovered during live validation.

Why this change

  • Skills source/provider handling was not explicit enough in settings and install endpoints (skillsmp vs skillssh paths were not fully aligned with provider intent).
  • AUTO mode relied on simplistic matching and could miss relevant skills or pick weak candidates.
  • Skill enable/mode transitions had an inconsistency when toggling enabled state without an explicit mode.
  • A stale tracked build artifact (src/lib/dataPaths.js) could shadow TS module behavior and break dev startup in certain flows.

What changed

1) Provider-aware skills settings and install routing

  • Added persistent provider setting plumbing for skills provider selection.
  • Enforced provider-aware install routing in skills marketplace endpoints.
  • Enriched skill metadata to support better UI and decisioning:
    • mode
    • sourceProvider
    • tags
    • installCount
  • Added migration:
    • src/lib/db/migrations/027_skill_mode_and_metadata.sql

2) Dashboard skills UX improvements

  • Added provider selector to Memory & Skills settings.
  • Improved skills page with:
    • search/filter refinements
    • provider-aware defaults/popular behavior
    • explicit per-skill controls: on / off / auto
    • clearer uninstall/install interactions

3) Smarter AUTO skill injection

  • Expanded injection context passed into injectSkills(...) with model, formats, background reason, messages, and provider hints.
  • Replaced naive matching with a scored contextual approach and guardrails:
    • thresholded selection (AUTO_MIN_SCORE)
    • top-N cap (AUTO_MAX_SKILLS)
    • bias for provider-relevant matches
    • preserved explicit on/off semantics

4) API consistency fix for enable/mode transitions

  • PUT /api/skills/[id] now keeps enabled and mode coherent when clients toggle enabled without explicitly sending mode.

5) Runtime hardening and test stabilization

  • Deleted stale tracked artifact src/lib/dataPaths.js (prevent JS shadowing TS export behavior at runtime).
  • Stabilized translation-path assertions to match actual provider-preference behavior.
  • Forwarded clientHeaders through BaseExecutor retry path to preserve request behavior across retries.

Commit breakdown

  1. 85b6cabf feat: add provider-aware skills metadata and install routing
  2. e275fa30 feat: improve skills dashboard filtering and provider-aware marketplace UX
  3. ff012d0d feat: add scored AUTO skill injection with contextual signals
  4. f1f3e8d2 fix: stabilize translation-path assertions and remove stale dataPaths build artifact
  5. 32382598 fix: forward client headers through base executor retries

Files touched (high-level)

  • Skills injection/runtime:
    • src/lib/skills/injection.ts
    • open-sse/handlers/chatCore.ts
    • src/app/api/skills/[id]/route.ts
    • open-sse/executors/base.ts
  • Skills provider/backend:
    • src/lib/skills/providerSettings.ts (new)
    • src/shared/validation/settingsSchemas.ts
    • src/lib/skills/registry.ts
    • src/lib/skills/types.ts
    • src/app/api/skills/route.ts
    • src/app/api/skills/marketplace/install/route.ts
    • src/app/api/skills/skillssh/install/route.ts
    • src/lib/db/migrations/027_skill_mode_and_metadata.sql (new)
  • Dashboard/UI:
    • src/app/(dashboard)/dashboard/settings/components/MemorySkillsTab.tsx
    • src/app/(dashboard)/dashboard/skills/page.tsx
  • Test/runtime cleanup:
    • tests/unit/chatcore-translation-paths.test.ts
    • tests/unit/db-core-init.test.ts
    • tests/unit/skills-injection.test.ts
    • tests/unit/skills-provider-setting.test.ts
    • tests/unit/skills-skillssh.test.ts
    • src/lib/dataPaths.js (deleted)

Verification

All key checks passed on this branch:

npm run build
npm run typecheck:core
node --import tsx/esm --test tests/unit/skills-injection.test.ts
node --import tsx/esm --test tests/integration/skills-pipeline.test.ts

Additional run during investigation:

npm run test:coverage

No failing tests remained in the validated set after fixes.

Notes

  • Push permissions for origin were unavailable (403), so this PR is submitted from fork branch oyi77:investigation/skills-provider-memory-3.6.9 into upstream release/v3.6.9.
  • Local workspace contains unrelated untracked investigation artifacts not included in this PR.

oyi77 added 5 commits April 19, 2026 12:41
Introduce per-skill mode/source/tags metadata and settings-driven provider selection so installs and listing flow through the active provider consistently.
…ce UX

Expose provider-specific defaults, filtering, and on/off/auto controls so users can manage installed skills without loading every skill into context.
Use request/message/provider/background context to rank AUTO skills with limits and thresholds, while preserving on/off behavior and wiring context from chatCore.
… build artifact

Make chatcore translation tests assert contract behavior instead of brittle block ordering, and remove tracked compiled JS shadow file causing runtime export mismatch.
Preserve incoming client headers in BaseExecutor execute flow so retry paths keep the same upstream header context.
@oyi77
oyi77 requested a review from diegosouzapw as a code owner April 19, 2026 05:56

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a more sophisticated skill management system, including per-skill activation modes (on, off, auto), a semantic scoring mechanism for automatic skill injection, and support for multiple skill providers (SkillsMP and skills.sh). The changes span the database schema, API routes, and the dashboard UI. Feedback focuses on optimizing the semantic scoring loop by pre-calculating constant tokens and improving context extraction for the Responses API format to ensure accurate automatic skill selection.

Comment on lines +142 to +145
const contextTokens = extractTokens(contextText);
const nameTokens = splitNameTokens(skill.name);
const descriptionTokens = extractTokens(description);
const backgroundTokens = extractTokens(toLowerText(options.backgroundReason));

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The contextTokens and backgroundTokens are re-extracted from the context text and background reason for every candidate skill in the loop. Since these values are constant for the entire injection process, they should be computed once in injectSkills and passed to scoreAutoSkill to avoid redundant processing, especially as the number of installed skills increases.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 52345ef.

✅ Optimized AUTO scoring by precomputing contextTokens and backgroundTokens once per injectSkills(...) call, then passing them into scoreAutoSkill(...) for each candidate.

This removes repeated token extraction in the candidate loop while keeping scoring behavior unchanged.

sourceFormat,
targetFormat,
backgroundReason,
messages: Array.isArray(body.messages) ? body.messages : undefined,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The skill injection context currently only includes body.messages. For requests using the Responses API format, the conversation history is stored in body.input. This means contextual AUTO skill selection will be less accurate for these requests. Consider including body.input when body.messages is missing.

Suggested change
messages: Array.isArray(body.messages) ? body.messages : undefined,
messages: Array.isArray(body.messages) ? body.messages : (Array.isArray(body.input) ? body.input : undefined),

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 52345ef.

✅ chatCore now uses Responses API input as fallback context for skills injection:

  • body.messages when present
  • otherwise body.input when it is an array

Also added integration coverage in tests/integration/skills-pipeline.test.ts (responses input context participates in AUTO skill injection) to verify AUTO selection works for /v1/responses payloads.

diegosouzapw pushed a commit that referenced this pull request Apr 19, 2026
@diegosouzapw

Copy link
Copy Markdown
Collaborator

Thanks @oyi77 for this great contribution! 🎉 We've resolved the merge conflict locally and integrated it directly into the release/v3.6.9 branch. It will be part of the next release. We appreciate your effort!

@diegosouzapw diegosouzapw mentioned this pull request Apr 19, 2026
diegosouzapw added a commit that referenced this pull request Apr 19, 2026
* test: resolve typescript strictness complaints in unit tests

* Update Claude Code obfuscation to version 2.1.114 (#1403)

* fix(cloud-code): scope thinking stripping to executor boundaries (#1401)

* fix(cloud-code): scope thinking stripping to executors

* fix(cloud-code): guard antigravity normalized body

* Update Claude Code obfuscation to version 2.1.114

- Update Claude Code version from 2.1.87 to 2.1.114
- Update X-Stainless-Package-Version from 0.80.0 to 0.81.0
- Add new beta flags: redact-thinking-2026-02-12, advisor-tool-2026-03-01, advanced-tool-use-2025-11-20
- Add missing headers: anthropic-version, anthropic-dangerous-direct-browser-access, x-app, X-Stainless-Timeout
- Add all X-Stainless-* headers (Arch, Lang, OS, Runtime, Runtime-Version, Retry-Count)
- Fix accept-encoding header: identity -> gzip, deflate, br, zstd
- Add connection: keep-alive header
- Update tool name mapping: add lsp, apply_patch, websearch

These changes ensure that requests from OpenCode through Omniroute are indistinguishable from genuine Claude Code 2.1.114 requests, allowing proper authentication with Anthropic's API without triggering extra credits errors.

* fix: resolve CodeQL password hash alert and TruffleHog CI failure

---------

Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>

* fix(claude-code): scope obfuscation to cli clients and fix tests

* docs(workflows): enforce PR merge instead of manual close

* docs(changelog): update 3.6.9 notes with missing PR 1403 and fixes

* docs(workflows): update generate-release to use full changelog for PR body

* fix(tsc): silence baseUrl deprecation warnings for TS 5.5+

* fix(chatcore): apply proactive compression before provider translation (#1406)

Integrated into release/v3.6.9

* docs(changelog): add PR 1406

* Makes text visible in dark-mode (#1409)

Integrated into release/v3.6.9

* docs(changelog): add PR 1409

* chore: save local work

* chore(release): sync version references to 3.6.9

* fix(codex): prevent proactive token refresh consumption and strip background parameter

* ci: shard long-running suites and relax timeouts

* ci: allow manual CI dispatch for release branches

* feat(skills): provider-aware marketplace UX, scored AUTO injection, and memory pipeline hardening (#1411)

* fix/400 for GeminiCLI(add "ref" in GEMINI_UNSUPPORTED_SCHEMA_KEYS)

* feat(cc-compatible): align request shape with Claude CLI

* fix(cc-compatible): add Claude CLI system skeleton for OpenAI input

* preserve reasoning when translating chat to responses (#1414)

Integrated into release/v3.6.9

* fix(skills): optimize AUTO scoring and include Responses input context (#1418)

Integrated into release/v3.6.9

* chore: fix TS errors and update review-prs workflow

* fix(api): stop sending unsupported Gemini and Codex parameters

Prevent Gemini request translation from injecting default
thoughtSignature values that the upstream API strictly validates and
rejects. Only preserve real signatures resolved from prior upstream
responses, and strip additionalProperties from Gemini function schemas
to avoid 400 "Unknown name" errors.

Also remove fallback-injected session_id and conversation_id fields
before sending Codex requests, and restore compatibility with the
legacy OUTBOUND_SSRF_GUARD_ENABLED flag when determining whether
private provider URLs are allowed.

Updates the Gemini translator and regression tests for issue #1410
and related 400 error cases.

* fix(core): stabilization fixes for token refresh, usage translation, and testing

- Update Codex token refresh detection logic
- Mark provider connections invalid on unrecoverable refresh error
- Fix Claude usage translation under-reporting cached tokens
- Update test expectations
- Update CHANGELOG.md for v3.6.9

* fix(auth): reload fresh token state and unify expiry persistence

Refresh checks now re-read the latest stored provider connection before
attempting rotation so they do not use stale refresh tokens captured by
an earlier sweep.

Token updates also persist both expiresAt and tokenExpiresAt across the
health check, usage-limit refresh path, and SSE refresh flow. This keeps
known token expiry metadata in sync and avoids interval-based refreshes
for connections whose tokens are still valid well into the future.

* fix: resolve SSRF environment static evaluation bug (#1427)

Fix import aliases and strict TS typings for tests and ACP agents.

* test: resolve remaining strict type errors in test files

* test: fix provider service assertion for anthropic-compatible header

* fix(codex): respect openaiStoreEnabled setting during native passthrough (#1432)

* fix(codex): fix token refresh unrecoverable detection for expired tokens

* fix(ci): restore release v3.6.9 build and flaky tests

* fix(cc-compatible): trim default OpenAI system skeleton (#1433)

Integrated into release/v3.6.9

* fix: prevent masked API keys from being written to CLI tool configs (#1435)

* feat: mark Qwen provider as deprecated and add deprecation warning to CLI tool (#1437)

* docs(changelog): comprehensive v3.6.9 update with all 59 commits since v3.6.8

* test(ci): align qwen guide settings assertions

* fix(security): resolve CodeQL alert 163 for incomplete URL sanitization in Qwen CLI settings

---------

Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <74762779+nikolay-popov-ideogram@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Tim Massey <tim-massey@users.noreply.github.com>
Co-authored-by: Paijo <oyi77@users.noreply.github.com>
Co-authored-by: dail45 <dail45@yandex.ru>
Co-authored-by: R.D. <rogerproself@gmail.com>
@diegosouzapw diegosouzapw mentioned this pull request Apr 22, 2026
This was referenced Apr 30, 2026
Poid-ZA pushed a commit to Poid-ZA/OmniRoute that referenced this pull request Aug 5, 2026
* test: resolve typescript strictness complaints in unit tests

* Update Claude Code obfuscation to version 2.1.114 (cheaper-inference#1403)

* fix(cloud-code): scope thinking stripping to executor boundaries (cheaper-inference#1401)

* fix(cloud-code): scope thinking stripping to executors

* fix(cloud-code): guard antigravity normalized body

* Update Claude Code obfuscation to version 2.1.114

- Update Claude Code version from 2.1.87 to 2.1.114
- Update X-Stainless-Package-Version from 0.80.0 to 0.81.0
- Add new beta flags: redact-thinking-2026-02-12, advisor-tool-2026-03-01, advanced-tool-use-2025-11-20
- Add missing headers: anthropic-version, anthropic-dangerous-direct-browser-access, x-app, X-Stainless-Timeout
- Add all X-Stainless-* headers (Arch, Lang, OS, Runtime, Runtime-Version, Retry-Count)
- Fix accept-encoding header: identity -> gzip, deflate, br, zstd
- Add connection: keep-alive header
- Update tool name mapping: add lsp, apply_patch, websearch

These changes ensure that requests from OpenCode through Omniroute are indistinguishable from genuine Claude Code 2.1.114 requests, allowing proper authentication with Anthropic's API without triggering extra credits errors.

* fix: resolve CodeQL password hash alert and TruffleHog CI failure

---------

Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>

* fix(claude-code): scope obfuscation to cli clients and fix tests

* docs(workflows): enforce PR merge instead of manual close

* docs(changelog): update 3.6.9 notes with missing PR 1403 and fixes

* docs(workflows): update generate-release to use full changelog for PR body

* fix(tsc): silence baseUrl deprecation warnings for TS 5.5+

* fix(chatcore): apply proactive compression before provider translation (cheaper-inference#1406)

Integrated into release/v3.6.9

* docs(changelog): add PR 1406

* Makes text visible in dark-mode (cheaper-inference#1409)

Integrated into release/v3.6.9

* docs(changelog): add PR 1409

* chore: save local work

* chore(release): sync version references to 3.6.9

* fix(codex): prevent proactive token refresh consumption and strip background parameter

* ci: shard long-running suites and relax timeouts

* ci: allow manual CI dispatch for release branches

* feat(skills): provider-aware marketplace UX, scored AUTO injection, and memory pipeline hardening (cheaper-inference#1411)

* fix/400 for GeminiCLI(add "ref" in GEMINI_UNSUPPORTED_SCHEMA_KEYS)

* feat(cc-compatible): align request shape with Claude CLI

* fix(cc-compatible): add Claude CLI system skeleton for OpenAI input

* preserve reasoning when translating chat to responses (cheaper-inference#1414)

Integrated into release/v3.6.9

* fix(skills): optimize AUTO scoring and include Responses input context (cheaper-inference#1418)

Integrated into release/v3.6.9

* chore: fix TS errors and update review-prs workflow

* fix(api): stop sending unsupported Gemini and Codex parameters

Prevent Gemini request translation from injecting default
thoughtSignature values that the upstream API strictly validates and
rejects. Only preserve real signatures resolved from prior upstream
responses, and strip additionalProperties from Gemini function schemas
to avoid 400 "Unknown name" errors.

Also remove fallback-injected session_id and conversation_id fields
before sending Codex requests, and restore compatibility with the
legacy OUTBOUND_SSRF_GUARD_ENABLED flag when determining whether
private provider URLs are allowed.

Updates the Gemini translator and regression tests for issue cheaper-inference#1410
and related 400 error cases.

* fix(core): stabilization fixes for token refresh, usage translation, and testing

- Update Codex token refresh detection logic
- Mark provider connections invalid on unrecoverable refresh error
- Fix Claude usage translation under-reporting cached tokens
- Update test expectations
- Update CHANGELOG.md for v3.6.9

* fix(auth): reload fresh token state and unify expiry persistence

Refresh checks now re-read the latest stored provider connection before
attempting rotation so they do not use stale refresh tokens captured by
an earlier sweep.

Token updates also persist both expiresAt and tokenExpiresAt across the
health check, usage-limit refresh path, and SSE refresh flow. This keeps
known token expiry metadata in sync and avoids interval-based refreshes
for connections whose tokens are still valid well into the future.

* fix: resolve SSRF environment static evaluation bug (cheaper-inference#1427)

Fix import aliases and strict TS typings for tests and ACP agents.

* test: resolve remaining strict type errors in test files

* test: fix provider service assertion for anthropic-compatible header

* fix(codex): respect openaiStoreEnabled setting during native passthrough (cheaper-inference#1432)

* fix(codex): fix token refresh unrecoverable detection for expired tokens

* fix(ci): restore release v3.6.9 build and flaky tests

* fix(cc-compatible): trim default OpenAI system skeleton (cheaper-inference#1433)

Integrated into release/v3.6.9

* fix: prevent masked API keys from being written to CLI tool configs (cheaper-inference#1435)

* feat: mark Qwen provider as deprecated and add deprecation warning to CLI tool (cheaper-inference#1437)

* docs(changelog): comprehensive v3.6.9 update with all 59 commits since v3.6.8

* test(ci): align qwen guide settings assertions

* fix(security): resolve CodeQL alert 163 for incomplete URL sanitization in Qwen CLI settings

---------

Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <74762779+nikolay-popov-ideogram@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Tim Massey <tim-massey@users.noreply.github.com>
Co-authored-by: Paijo <oyi77@users.noreply.github.com>
Co-authored-by: dail45 <dail45@yandex.ru>
Co-authored-by: R.D. <rogerproself@gmail.com>
muhamadgalihsaputra pushed a commit to niyatna/NiyatnaRoute that referenced this pull request Sep 27, 2026
* test: resolve typescript strictness complaints in unit tests

* Update Claude Code obfuscation to version 2.1.114 (cheaper-inference#1403)

* fix(cloud-code): scope thinking stripping to executor boundaries (cheaper-inference#1401)

* fix(cloud-code): scope thinking stripping to executors

* fix(cloud-code): guard antigravity normalized body

* Update Claude Code obfuscation to version 2.1.114

- Update Claude Code version from 2.1.87 to 2.1.114
- Update X-Stainless-Package-Version from 0.80.0 to 0.81.0
- Add new beta flags: redact-thinking-2026-02-12, advisor-tool-2026-03-01, advanced-tool-use-2025-11-20
- Add missing headers: anthropic-version, anthropic-dangerous-direct-browser-access, x-app, X-Stainless-Timeout
- Add all X-Stainless-* headers (Arch, Lang, OS, Runtime, Runtime-Version, Retry-Count)
- Fix accept-encoding header: identity -> gzip, deflate, br, zstd
- Add connection: keep-alive header
- Update tool name mapping: add lsp, apply_patch, websearch

These changes ensure that requests from OpenCode through Omniroute are indistinguishable from genuine Claude Code 2.1.114 requests, allowing proper authentication with Anthropic's API without triggering extra credits errors.

* fix: resolve CodeQL password hash alert and TruffleHog CI failure

---------

Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>

* fix(claude-code): scope obfuscation to cli clients and fix tests

* docs(workflows): enforce PR merge instead of manual close

* docs(changelog): update 3.6.9 notes with missing PR 1403 and fixes

* docs(workflows): update generate-release to use full changelog for PR body

* fix(tsc): silence baseUrl deprecation warnings for TS 5.5+

* fix(chatcore): apply proactive compression before provider translation (cheaper-inference#1406)

Integrated into release/v3.6.9

* docs(changelog): add PR 1406

* Makes text visible in dark-mode (cheaper-inference#1409)

Integrated into release/v3.6.9

* docs(changelog): add PR 1409

* chore: save local work

* chore(release): sync version references to 3.6.9

* fix(codex): prevent proactive token refresh consumption and strip background parameter

* ci: shard long-running suites and relax timeouts

* ci: allow manual CI dispatch for release branches

* feat(skills): provider-aware marketplace UX, scored AUTO injection, and memory pipeline hardening (cheaper-inference#1411)

* fix/400 for GeminiCLI(add "ref" in GEMINI_UNSUPPORTED_SCHEMA_KEYS)

* feat(cc-compatible): align request shape with Claude CLI

* fix(cc-compatible): add Claude CLI system skeleton for OpenAI input

* preserve reasoning when translating chat to responses (cheaper-inference#1414)

Integrated into release/v3.6.9

* fix(skills): optimize AUTO scoring and include Responses input context (cheaper-inference#1418)

Integrated into release/v3.6.9

* chore: fix TS errors and update review-prs workflow

* fix(api): stop sending unsupported Gemini and Codex parameters

Prevent Gemini request translation from injecting default
thoughtSignature values that the upstream API strictly validates and
rejects. Only preserve real signatures resolved from prior upstream
responses, and strip additionalProperties from Gemini function schemas
to avoid 400 "Unknown name" errors.

Also remove fallback-injected session_id and conversation_id fields
before sending Codex requests, and restore compatibility with the
legacy OUTBOUND_SSRF_GUARD_ENABLED flag when determining whether
private provider URLs are allowed.

Updates the Gemini translator and regression tests for issue cheaper-inference#1410
and related 400 error cases.

* fix(core): stabilization fixes for token refresh, usage translation, and testing

- Update Codex token refresh detection logic
- Mark provider connections invalid on unrecoverable refresh error
- Fix Claude usage translation under-reporting cached tokens
- Update test expectations
- Update CHANGELOG.md for v3.6.9

* fix(auth): reload fresh token state and unify expiry persistence

Refresh checks now re-read the latest stored provider connection before
attempting rotation so they do not use stale refresh tokens captured by
an earlier sweep.

Token updates also persist both expiresAt and tokenExpiresAt across the
health check, usage-limit refresh path, and SSE refresh flow. This keeps
known token expiry metadata in sync and avoids interval-based refreshes
for connections whose tokens are still valid well into the future.

* fix: resolve SSRF environment static evaluation bug (cheaper-inference#1427)

Fix import aliases and strict TS typings for tests and ACP agents.

* test: resolve remaining strict type errors in test files

* test: fix provider service assertion for anthropic-compatible header

* fix(codex): respect openaiStoreEnabled setting during native passthrough (cheaper-inference#1432)

* fix(codex): fix token refresh unrecoverable detection for expired tokens

* fix(ci): restore release v3.6.9 build and flaky tests

* fix(cc-compatible): trim default OpenAI system skeleton (cheaper-inference#1433)

Integrated into release/v3.6.9

* fix: prevent masked API keys from being written to CLI tool configs (cheaper-inference#1435)

* feat: mark Qwen provider as deprecated and add deprecation warning to CLI tool (cheaper-inference#1437)

* docs(changelog): comprehensive v3.6.9 update with all 59 commits since v3.6.8

* test(ci): align qwen guide settings assertions

* fix(security): resolve CodeQL alert 163 for incomplete URL sanitization in Qwen CLI settings

---------

Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <74762779+nikolay-popov-ideogram@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Tim Massey <tim-massey@users.noreply.github.com>
Co-authored-by: Paijo <oyi77@users.noreply.github.com>
Co-authored-by: dail45 <dail45@yandex.ru>
Co-authored-by: R.D. <rogerproself@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants