chore(release): v3.8.53 merge-train validation (do not merge)

.env.example

@@ -485,6 +485,7 @@ AUTH_COOKIE_SECURE=false
 # Require an API key for all /v1/* proxy endpoints.
 # Used by: API middleware — rejects unauthenticated requests to the proxy API.
 # Default: false  |  Set true for multi-user/public deployments.
+# On: true, 1 or yes (case and surrounding spaces ignored). Any other value is off.
 # Leaving this false is only safe when the app is reachable on loopback only
 # (see APP_BIND_HOST above) or sits behind a reverse proxy doing its own auth.
 REQUIRE_API_KEY=false
@@ -522,7 +523,8 @@ ALLOW_API_KEY_REVEAL=false
 # Used by: src/shared/utils/apiKeyPolicy.ts — checkRateLimit() fallback.
 # DEFAULT_RATE_LIMIT_PER_DAY=1000
 
-# Maximum request body size in bytes (rejects larger payloads).
+# Maximum request body size in bytes (rejects larger payloads). A saved maxBodySizeMb wins.
+# Chat Completions and Responses keep a 50 MB default until a limit is saved.
 # Used by: src/shared/middleware/bodySizeGuard.ts — prevents oversized uploads.
 # Default: 10485760 (10 MB)
 # MAX_BODY_SIZE_BYTES=10485760
@@ -537,6 +539,7 @@ ALLOW_API_KEY_REVEAL=false
 # as structure-heavy. Default 262144 (256 KB).
 # OMNIROUTE_CHAT_LARGE_BODY_BYTES=262144
 # Actual-byte hard cap enforced during bounded ingestion. Default 52428800 (50 MB).
+# A saved maxBodySizeMb replaces the default; when set here, this also caps that saved value.
 # OMNIROUTE_CHAT_HARD_MAX_BODY_BYTES=52428800
 # Legacy request-COUNT cap (#503-fanout). Now binds only when explicitly set here —
 # left unset, heavyweight admission is gated by OMNIROUTE_CHAT_MAX_INFLIGHT_BYTES below
@@ -864,6 +867,15 @@ ALLOW_API_KEY_REVEAL=false
 # own cap. Positive integers only; unset or invalid values keep 128.
 # OMNIROUTE_MAX_TOOLS_LIMIT=128
 
+# Responses -> Chat translation re-sends tool-output images (function_call_output,
+# custom_tool_call_output, role "tool") as user image parts. Only the newest images within
+# both budgets are kept; each older one becomes a text placeholder with its tool_call_id,
+# and the cap logs one warning per request.
+# Used by: open-sse/translator/request/openai-responses.ts (selectDroppedToolOutputImages).
+# Positive integers only; unset or invalid values keep the defaults.
+# OMNIROUTE_TOOL_OUTPUT_IMAGE_MAX_COUNT=16
+# OMNIROUTE_TOOL_OUTPUT_IMAGE_MAX_BYTES=20971520
+
 # SYNTX.ai prompt-emulated tool calling. Unset = on: SYNTX chat injects the local
 # tool catalog into the prompt and parses <tool_call> blocks back into OpenAI
 # tool_calls. Set to 0/false/off to skip the local-tool catalog injection.
@@ -1369,8 +1381,9 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # before the dashboard polls. Default: 5000
 #PROVIDER_LIMITS_POST_USAGE_REFRESH_DELAY_MS=5000
 
-# Disable all background services (sync, pricing, model refresh).
-# Used by: src/instrumentation-node.ts, src/lib/initCloudSync.ts
+# Disable all background services (sync, pricing, model refresh, connection recovery,
+# credential health, retention cleanup, scheduled VACUUM, settings hot-reload poll).
+# Used by: src/lib/env/backgroundServices.ts, src/lib/initCloudSync.ts
 # Useful for: CI builds, test environments, or resource-constrained containers.
 # OMNIROUTE_DISABLE_BACKGROUND_SERVICES=false
 
@@ -1421,7 +1434,7 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 #OMNIROUTE_LOG_EXPORT_CHILD_MAX_OLD_SPACE_MB=1024
 
 # Emergency budget-exhaustion fallback (set false or 0 to disable the reroute to
-# nvidia/openai/gpt-oss-120b when a request fails with a 402 budget error).
+# nvidia/nvidia/nemotron-3.5-super-vl-120b-a12b when a request fails with a 402 budget error).
 # Used by: open-sse/services/emergencyFallback.ts.  Default: enabled.
 #OMNIROUTE_EMERGENCY_FALLBACK=true
 
@@ -2010,6 +2023,10 @@ CURSOR_USER_AGENT="Cursor/3.4"
 #                                     # Used when the direct upstream URL is private/LAN
 #                                     # so native Ollama cold-start TTFB can exceed 30s.
 #                                     # Default: 300000 = 5 min. See docs/guides/LOCAL_OLLAMA_DOCKER.md
+# OMNIROUTE_DIRECT_HEADERS_VOLUME_ADAPTIVE=1  # Raise the direct response-start window by
+#                                     # payload tier (>512KB ×2, >2MB ×3, capped at 180s,
+#                                     # never lowering a higher floor). Set 0/false/off
+#                                     # to pin the flat window. Default: 1.
 # OMNIROUTE_DIRECT_RESPONSE_RETRY_TIMEOUT_MS=600000  # Ceiling (ms) for the fresh-socket
 #                                     # RETRY attempt above (#13703). Only applies when
 #                                     # the caller already attached its own deadline

.github/workflows/docker-publish.yml

@@ -340,6 +340,22 @@ jobs:
         env:
           DOCKER_BUILDKIT_INLINE_CACHE: 1
 
+      # Check the binaries in both final Node images on each native architecture,
+      # before their digests can reach the multi-arch manifest/promotion job.
+      - name: Verify published Node runtimes
+        env:
+          DIGEST_BASE: ${{ steps.build.outputs.digest }}
+          DIGEST_WEB: ${{ steps.build-web.outputs.digest }}
+          PLATFORM: ${{ matrix.platform }}
+        run: |
+          set -euo pipefail
+          for digest in "$DIGEST_BASE" "$DIGEST_WEB"; do
+            image="${GHCR_IMAGE_NAME}@${digest}"
+            echo "Verifying Node runtime in ${image} (${PLATFORM})"
+            docker run --rm --pull always --platform "$PLATFORM" --entrypoint node -i \
+              "$image" --input-type=module < scripts/ci/check-docker-node-runtime.mjs
+          done
+
       - name: Build and push BUN base platform image by digest
         id: build-bun-base
         # Bun is a best-effort compatibility target, not a supported runtime

@omniroute/opencode-plugin-v2/README.md

@@ -109,7 +109,7 @@ server reads it, not only in the shell that runs `opencode models`.
 | `managementReadToken`                   | option, then `OMNIROUTE_MANAGEMENT_API_KEY`, then `apiKey` | Management key for `/api/*` (combos, providers, enrichment) — usually **not** the same key                                                                                                                                                                                               |
 | `displayName`                           | `"OmniRoute"`                                              | Provider display name                                                                                                                                                                                                                                                                    |
 | `timeoutMs`                             | `10000`                                                    | Per-endpoint fetch timeout                                                                                                                                                                                                                                                               |
-| `modelCacheTtlMs`                       | `300000`                                                   | Catalog cache TTL; disk snapshot warms cold starts                                                                                                                                                                                                                                       |
+| `modelCacheTtlMs`                       | `300000`                                                   | Catalog cache TTL and background refresh period (minimum 60000 ms): the served catalog follows the gateway within this window, with no service restart; disk snapshot warms cold starts                                                                                                  |
 | `timeouts`                              | per-endpoint override                                      | `{ models, combos, enrichment }` in ms; falls back to `timeoutMs` (`autoCombos` still parses but is ignored — the virtual-entries route is no longer requested)                                                                                                                          |
 | `enrichment`                            | `true`                                                     | Fetch names + pricing (`/api/pricing*`, `/api/free-tier/summary`)                                                                                                                                                                                                                        |
 | `providerTag`                           | `true`                                                     | Prefix a display name with the upstream provider it routes to                                                                                                                                                                                                                            |

@omniroute/opencode-plugin-v2/src/cache.ts

@@ -13,6 +13,13 @@ import { isHttpUrl } from "./shared/index.js";
 
 export const DEFAULT_MODEL_CACHE_TTL_MS = 300_000 as const;
 
+/**
+ * Lower bound on the background refresh period. Keeps the loop from spinning
+ * on configurations that set a tiny TTL (the existing tests use 1 ms) and
+ * matches the v1 minimum.
+ */
+export const MIN_REFRESH_INTERVAL_MS = 60_000 as const;
+
 /**
  * Breather after a refresh whose models fetch came back empty (gateway down
  * or refusing). Transforms inside the window serve last-known-good without

@omniroute/opencode-plugin-v2/src/index.ts

@@ -17,12 +17,14 @@ import { buildProviderPayload, collectCatalog } from "./catalog.js";
 import { usesModelsComboSource } from "./combos-source.js";
 import {
   UNREACHABLE_COOLDOWN_MS,
+  MIN_REFRESH_INTERVAL_MS,
   memoryCacheKey,
   readDiskSnapshot,
   snapshotIdentityFingerprint,
   writeDiskSnapshot,
   type CatalogSnapshot,
 } from "./cache.js";
+import { startRefreshLoop } from "./refresh-loop.js";
 import { assertContext } from "./compat.js";
 import { type ApiKeyOrigin, resolveApiKey, warnIfMissing } from "./credentials.js";
 import { createSourceErrorReporter } from "./enrichment-report.js";
@@ -136,6 +138,11 @@ export default Plugin.define({
       unreachableUntil: 0,
     };
 
+    // Per-installation stopped flag for the background refresh loop. Declared
+    // up front so the closures below can reference it without a temporal
+    // dead zone, and so a tick that lands after teardown publishes nothing.
+    let stopped = false;
+
     // The credential the host holds wins over one written in config, so a
     // user who connected the integration from the UI never has to paste a
     // key into `opencode.json`. Reading it is async and the transforms must
@@ -164,9 +171,16 @@ export default Plugin.define({
       if (credentialChecked && apiKeyOrigin !== "missing") return;
       const next = await resolveApiKey(ctx, X, parsed.apiKey, log);
       const moved = next.key !== resolved.apiKey;
+      const previousCacheKey = cacheKey;
       resolved.apiKey = next.key;
       apiKeyOrigin = next.origin;
-      if (moved) ({ cacheKey, identityFingerprint } = credentialsOf());
+      if (moved) {
+        ({ cacheKey, identityFingerprint } = credentialsOf());
+        // Drop the stale entry so the memory cache does not grow across a
+        // credential change.
+        state.entries.delete(previousCacheKey);
+        state.inFlight.delete(previousCacheKey);
+      }
       if (!credentialChecked) warnIfMissing(next, X, log);
       else if (moved) log.info(`[omniroute-v2] API key picked up from the ${next.origin} source`);
       credentialChecked = true;
@@ -304,7 +318,7 @@ export default Plugin.define({
         enrichment: previous?.enrichment ?? new Map(),
         fetchedAt: Date.now(),
       };
-      if (models.length > 0) {
+      if (!stopped && models.length > 0) {
         state.entries.set(cacheKey, snapshot);
         await writeDiskSnapshot(X, snapshot, identityFingerprint, log);
       }
@@ -334,6 +348,7 @@ export default Plugin.define({
         SourceResult<OmniRouteEnrichmentMap>,
       ]
     ): Promise<void> {
+      if (stopped) return;
       if (state.entries.get(cacheKey) !== base) return;
       // Per source: a success replaces (even with an empty answer — that is
       // the gateway's answer), a failure keeps what we had.
@@ -362,7 +377,7 @@ export default Plugin.define({
       );
       const optionalChanged = state.optionalFingerprint !== optionalFingerprint;
       state.optionalFingerprint = optionalFingerprint;
-      if (optionalChanged) {
+      if (optionalChanged && !stopped) {
         try {
           await ctx.provider.reload();
         } catch (err) {
@@ -373,10 +388,11 @@ export default Plugin.define({
       }
     }
 
-    function loadSnapshot(): Promise<CatalogSnapshot> {
+    function loadSnapshot(force = false): Promise<CatalogSnapshot> {
       const now = Date.now();
       const hit = state.entries.get(cacheKey);
-      if (hit && hit.fetchedAt + resolved.modelCacheTtlMs > now) return Promise.resolve(hit);
+      if (!force && hit && hit.fetchedAt + resolved.modelCacheTtlMs > now)
+        return Promise.resolve(hit);
       // Cooldown after a total models failure: skip the network until it
       // lapses. Serves last-known-good when one exists; otherwise the refresh
       // below still runs (nothing to serve, no point pretending).
@@ -427,10 +443,13 @@ export default Plugin.define({
     // setup publishes first, then the host replays the callback (during
     // registration and on every reload) and reads the published snapshot.
     let latest: { info: unknown; models: unknown[] } | undefined;
-    const refreshAndPublish = async (): Promise<void> => {
+    const refreshAndPublish = async (options?: { force?: boolean }): Promise<void> => {
+      if (stopped) return;
       await ensureCredential();
+      if (stopped) return;
       await ensureWarmSnapshot();
-      const snapshot = await loadSnapshot();
+      const snapshot = await loadSnapshot(options?.force === true);
+      if (stopped) return;
       let effective = snapshot;
       if (snapshot.models.length === 0) {
         const stale = state.entries.get(cacheKey);
@@ -468,7 +487,7 @@ export default Plugin.define({
       const fingerprint = catalogContentFingerprint(effective.models, effective.combos);
       const changed = state.fingerprint !== undefined && state.fingerprint !== fingerprint;
       state.fingerprint = fingerprint;
-      if (changed) {
+      if (changed && !stopped) {
         await Promise.resolve();
         try {
           await ctx.provider.reload();
@@ -621,5 +640,53 @@ export default Plugin.define({
         );
       }
     }
+
+    // Background refresh loop: keep the served catalog aligned with the
+    // gateway. The first publish above already populated `latest`; the loop
+    // only re-runs refreshAndPublish on the configured TTL.
+    // Registry of live loops, keyed by providerId, scoped to globalThis so it
+    // survives module re-evaluation (the host loads the plugin up to ~20
+    // times per process). Defense in depth behind the Cleanup returned below.
+    const registryKey = Symbol.for("omniroute.opencode-plugin-v2.refresh-loops");
+    const g = globalThis as unknown as Record<
+      symbol,
+      Map<string, { stop: () => void; state: RefreshState }>
+    >;
+    if (!g[registryKey]) g[registryKey] = new Map();
+    const registry = g[registryKey];
+    // Stop any loop already registered for this providerId.
+    const existing = registry.get(X);
+    if (existing) {
+      try {
+        existing.stop();
+      } catch {
+        // ignore
+      }
+      registry.delete(X);
+    }
+
+    const stopLoop = startRefreshLoop({
+      intervalMs: Math.max(MIN_REFRESH_INTERVAL_MS, resolved.modelCacheTtlMs),
+      refresh: () => refreshAndPublish({ force: true }),
+      logger: log,
+    });
+
+    // Cleanup returned to the host: flag the installation as stopped (a tick
+    // already in flight then publishes nothing), clear the timer and drop the
+    // registry entry. The entry carries `state` only so tests can inspect the
+    // memory cache.
+    const stop = () => {
+      stopped = true;
+      try {
+        stopLoop();
+      } catch {
+        // ignore
+      }
+      registry.delete(X);
+    };
+
+    registry.set(X, { stop, state });
+
+    return stop;
   },
 });

@omniroute/opencode-plugin-v2/src/refresh-loop.ts

@@ -0,0 +1,43 @@
+export interface RefreshLoopOptions {
+  intervalMs: number;
+  refresh: () => Promise<void>;
+  logger: { warn: (message: string) => void; debug?: (message: string) => void };
+}
+
+/**
+ * Run `refresh` on a fixed interval without overlapping invocations.
+ *
+ * Returns a `stop` function that sets the stopped flag and clears the
+ * interval. `unref()` is guarded so the timer never keeps the process
+ * alive and works on both Node 22 and Node 24.
+ */
+export function startRefreshLoop(options: RefreshLoopOptions): () => void {
+  const { intervalMs, refresh, logger } = options;
+  let stopped = false;
+  let inFlight = false;
+
+  const tick = async (): Promise<void> => {
+    if (stopped) return;
+    if (inFlight) return;
+    inFlight = true;
+    try {
+      await refresh();
+    } catch (err) {
+      logger.warn(
+        `[omniroute-v2] background refresh failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    } finally {
+      inFlight = false;
+    }
+  };
+
+  const timer = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  if (typeof timer.unref === "function") timer.unref();
+
+  return () => {
+    stopped = true;
+    clearInterval(timer);
+  };
+}