fix(models): memoize getModelsDevPricing (event loop / healthz) by RaviTharuma · Pull Request #10055 · diegosouzapw/OmniRoute

RaviTharuma · 2026-08-10T23:22:13Z

Summary

Fixes #9685 (primary) and materially reduces #10052 probe timeouts when /v1/models is the hot path.

resolveCatalogPricing called getModelsDevPricing() once per model while building the unified catalog. Each call re-ran:

SELECT key, value FROM key_value WHERE namespace = 'models_dev_pricing'

and JSON.parsed every pricing row. On a large catalog that is ~10k SQL scans and multi‑GB of JSON parse work, holding the Node event loop so all HTTP handlers — including stock /healthz — stop answering.

Change

Process-local memo of the parsed PricingByProvider map
Invalidate on saveModelsDevPricing / clearModelsDevPricing (same write path that already calls invalidateDbCache("pricing"))
Unit test: same-object memo + invalidation on clear/save

Why not a separate health server?

Same-process side channels do not help when the loop is CPU-blocked. Fixing the hog is the correct root-cause fix for both issues.

Test plan

Unit test getModelsDevPricing memoizes until save/clear (#9685)
CI unit suite
Manual: GET /v1/models on a large pricing set stays under a few seconds; concurrent GET /healthz remains 200

Security

No secrets or private hostnames.

resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com>

Copilot

Pull request overview

This PR addresses event-loop starvation during /v1/models catalog assembly by memoizing getModelsDevPricing() (avoiding repeated full-table scans + JSON parsing) and invalidating that memo on pricing writes.

Changes:

Added a process-local memo for getModelsDevPricing() and invalidated it on saveModelsDevPricing / clearModelsDevPricing.
Added a unit test asserting memoization and invalidation behavior for models.dev pricing reads.

Verification (custom)

Commands run: none (review-only)
Changed test files: tests/unit/modelsDevSync-extended.test.ts
Coverage result (npm run test:coverage): not provided / not verified in this review

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`src/lib/modelsDevSync.ts`	Adds a process-local memo for models.dev pricing reads and invalidates it on save/clear.
`tests/unit/modelsDevSync-extended.test.ts`	Adds a unit test for memoization + invalidation of models.dev pricing reads.

Suppressed comments (1)

src/lib/modelsDevSync.ts:236

getModelsDevPricing() should record which DB instance the memo was built from; otherwise the cache-busting comparison against the current getDbInstance() handle can’t work reliably after a reset.

  modelsDevPricingCache = synced;
  return synced;

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+let modelsDevPricingCache: PricingByProvider | null = null;
+
+function invalidateModelsDevPricingCache(): void {
+  modelsDevPricingCache = null;
+}


+  // Mutating DB under the cache must not be visible until invalidation.
+  const db = core.getDbInstance();
+  db.prepare("DELETE FROM key_value WHERE namespace = 'models_dev_pricing'").run();
+  assert.equal(
+    modelsDev.getModelsDevPricing(),
+    first,
+    "raw SQL without save/clear must not bypass the memo"
+  );


…10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts

Resolve catalog cache key conflict by combining the API-key hash fingerprint with the base's hideAuto/hideNoThink key segments; take base's version-checked getModelsDevPricing memo and its restructured test file (base diegosouzapw#10055 supersedes the older memo port); take base .gitignore and package-lock. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189, #190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot #189, #190. Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (#9685, #10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot #10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(ops): Docker HEALTHCHECK probes /healthz not deep monitoring /api/monitoring/health does a SQLite ping and more. When the event loop is busy the official image HEALTHCHECK (5s timeout) marks the container Unhealthy and orchestrators restart the only replica mid-session. * fix(ops): keep healthcheck PR scoped to the /healthz probe Drop the stray catalog ghost-model exclusion that leaked into this branch from main (already covered upstream). Restore catalog.ts to the release version so the PR contains only the Docker HEALTHCHECK /healthz fix, its tests, and the changelog entry. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: adevwithpurpose <adevwithpurpose@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…10299) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189, #190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot #189, #190. Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (#9685, #10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot #10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(models): honor MODELS_DEV_SYNC_ENABLED=0 over dashboard settings The file header already advertised this env var but nothing read it. When catalog/compression pin the event loop, the dashboard (same process) cannot turn models.dev sync off. Let 0/false/off win over sqlite so an operator can recover with env + restart. Skip getModelsDevPricing SQL scans while the kill switch is set. * fix(models): restore prettier formatting after base merge Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * test(models): cover env kill switch during live settings updates Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: adevwithpurpose <adevwithpurpose@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

#10356) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189, #190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot #189, #190. Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (#9685, #10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot #10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(providers): remove invalid CodeBuddy CN glm-4.7 and add hy3 (0.0x credit) Swap the GLM-4.7 model for the Hunyuan hy3 model in the codebuddy-cn registry, keep the catalog at 15 models, and update the matching provider test expectations. Regenerated the auto-generated provider reference doc. --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189, #190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot #189, #190. Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (#9685, #10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot #10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(sse): keep Codex quota headers under the forwarding budget The 768-byte cap plus priority-3 for any name that does not contain "ratelimit" dropped x-codex-*-used-percent / reset / credits on every stream. x-codex-turn-state (314 bytes) ate the budget. Raise the cap, treat Codex quota headers as rate-limit priority, and do not forward turn-state. --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>

…ed budget) (#10253) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189, #190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot #189, #190. Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (#9685, #10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot #10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(api): scale pool usage snapshot limits by member count (summed budget) --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…d port (#10517) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189, #190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot #189, #190. Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (#9685, #10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot #10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(oauth): route Zed hosted sign-in callback back to the dashboard port Zed's native-app sign-in always redirects the browser to the loopback port sent as native_app_port (hardcoded default 58443), where nothing listens: the browser shows "site can't be reached" and the login looks broken even though the token is in the URL. The manual paste fallback was broken too - handleManualSubmit requires a ?code= param that Zed's callback (user_id + access_token) never carries, so the flow could never complete. - zed-hosted: derive native_app_port from the dashboard's own loopback port so the redirect lands back on OmniRoute; remote/LAN origins keep the old default port and the paste flow - app root: forward ?user_id=...&access_token=... to the /callback relay instead of dropping the query string on the /dashboard redirect - /callback relay: recognize the Zed payload (no code param) and relay the full URL as the exchange payload; allow postMessage to both loopback spellings (localhost/127.0.0.1) of the same port - OAuthModal: zed-hosted popup auto-completes on true localhost; the manual paste path passes the full URL through to the exchange instead of erroring with "No authorization code found" - manual input panel: zed-hosted-specific placeholder and hint - tests: extend the postMessage scope guard with the loopback same-port trusted origins * changelog: fragment for #10517 * fix(oauth): derive Zed native_app_port from server config, not browser scheme/port resolveDashboardLoopbackPort() previously re-derived the dashboard's loopback port from the browser-supplied redirectUri (window.location.port || protocol === "https:" ? "443" : "80"), which produced http://127.0.0.1:443/ native-app redirects when the dashboard was reached over HTTPS on its implicit default port (e.g. behind a local TLS-terminating reverse proxy) - a scheme/port mismatch, since Zed's own redirect is always plain http and nothing serves plain HTTP on 443 in that scenario. This code runs server-side (in the OAuth authorize API route), so once the redirect URI's hostname is confirmed loopback it now uses the OmniRoute process's own authoritative listening port via getRuntimePorts() (OMNIROUTE_PORT/PORT/DASHBOARD_PORT) instead of re-deriving it from the browser-observed scheme/port. Non-loopback (remote/LAN) redirect URIs still return null and fall back to the manual paste flow. Adds tests/unit/zed-hosted-loopback-port-derivation.test.ts (8 cases) covering the port-derivation logic directly, including the HTTPS-default-port mismatch scenario that motivated this fix, env-var precedence, IPv6 loopback, non-loopback/remote fallback, and buildAuthUrl's native_app_port wiring. Also rebaselines config/quality/file-size-baseline.json for OAuthModal.tsx's own growth from this PR's earlier commit (1134->1149 gate units) - legitimate zed-hosted callback wiring at the existing provider-switch chokepoint, not extractable without a broader modal decomposition (tracked in #3501). The live Zed OAuth handshake itself (root -> /callback -> OAuthModal exchange against the real zed.dev endpoint) still needs a documented VPS smoke test per Hard Rule #18; this fix covers the TDD-able port-derivation logic that motivated the change. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…ed budget) (diegosouzapw#10253) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(api): scale pool usage snapshot limits by member count (summed budget) --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…d port (diegosouzapw#10517) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(oauth): route Zed hosted sign-in callback back to the dashboard port Zed's native-app sign-in always redirects the browser to the loopback port sent as native_app_port (hardcoded default 58443), where nothing listens: the browser shows "site can't be reached" and the login looks broken even though the token is in the URL. The manual paste fallback was broken too - handleManualSubmit requires a ?code= param that Zed's callback (user_id + access_token) never carries, so the flow could never complete. - zed-hosted: derive native_app_port from the dashboard's own loopback port so the redirect lands back on OmniRoute; remote/LAN origins keep the old default port and the paste flow - app root: forward ?user_id=...&access_token=... to the /callback relay instead of dropping the query string on the /dashboard redirect - /callback relay: recognize the Zed payload (no code param) and relay the full URL as the exchange payload; allow postMessage to both loopback spellings (localhost/127.0.0.1) of the same port - OAuthModal: zed-hosted popup auto-completes on true localhost; the manual paste path passes the full URL through to the exchange instead of erroring with "No authorization code found" - manual input panel: zed-hosted-specific placeholder and hint - tests: extend the postMessage scope guard with the loopback same-port trusted origins * changelog: fragment for diegosouzapw#10517 * fix(oauth): derive Zed native_app_port from server config, not browser scheme/port resolveDashboardLoopbackPort() previously re-derived the dashboard's loopback port from the browser-supplied redirectUri (window.location.port || protocol === "https:" ? "443" : "80"), which produced http://127.0.0.1:443/ native-app redirects when the dashboard was reached over HTTPS on its implicit default port (e.g. behind a local TLS-terminating reverse proxy) - a scheme/port mismatch, since Zed's own redirect is always plain http and nothing serves plain HTTP on 443 in that scenario. This code runs server-side (in the OAuth authorize API route), so once the redirect URI's hostname is confirmed loopback it now uses the OmniRoute process's own authoritative listening port via getRuntimePorts() (OMNIROUTE_PORT/PORT/DASHBOARD_PORT) instead of re-deriving it from the browser-observed scheme/port. Non-loopback (remote/LAN) redirect URIs still return null and fall back to the manual paste flow. Adds tests/unit/zed-hosted-loopback-port-derivation.test.ts (8 cases) covering the port-derivation logic directly, including the HTTPS-default-port mismatch scenario that motivated this fix, env-var precedence, IPv6 loopback, non-loopback/remote fallback, and buildAuthUrl's native_app_port wiring. Also rebaselines config/quality/file-size-baseline.json for OAuthModal.tsx's own growth from this PR's earlier commit (1134->1149 gate units) - legitimate zed-hosted callback wiring at the existing provider-switch chokepoint, not extractable without a broader modal decomposition (tracked in diegosouzapw#3501). The live Zed OAuth handshake itself (root -> /callback -> OAuthModal exchange against the real zed.dev endpoint) still needs a documented VPS smoke test per Hard Rule diegosouzapw#18; this fix covers the TDD-able port-derivation logic that motivated the change. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…ed budget) (diegosouzapw#10253) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(api): scale pool usage snapshot limits by member count (summed budget) --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…d port (diegosouzapw#10517) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(oauth): route Zed hosted sign-in callback back to the dashboard port Zed's native-app sign-in always redirects the browser to the loopback port sent as native_app_port (hardcoded default 58443), where nothing listens: the browser shows "site can't be reached" and the login looks broken even though the token is in the URL. The manual paste fallback was broken too - handleManualSubmit requires a ?code= param that Zed's callback (user_id + access_token) never carries, so the flow could never complete. - zed-hosted: derive native_app_port from the dashboard's own loopback port so the redirect lands back on OmniRoute; remote/LAN origins keep the old default port and the paste flow - app root: forward ?user_id=...&access_token=... to the /callback relay instead of dropping the query string on the /dashboard redirect - /callback relay: recognize the Zed payload (no code param) and relay the full URL as the exchange payload; allow postMessage to both loopback spellings (localhost/127.0.0.1) of the same port - OAuthModal: zed-hosted popup auto-completes on true localhost; the manual paste path passes the full URL through to the exchange instead of erroring with "No authorization code found" - manual input panel: zed-hosted-specific placeholder and hint - tests: extend the postMessage scope guard with the loopback same-port trusted origins * changelog: fragment for diegosouzapw#10517 * fix(oauth): derive Zed native_app_port from server config, not browser scheme/port resolveDashboardLoopbackPort() previously re-derived the dashboard's loopback port from the browser-supplied redirectUri (window.location.port || protocol === "https:" ? "443" : "80"), which produced http://127.0.0.1:443/ native-app redirects when the dashboard was reached over HTTPS on its implicit default port (e.g. behind a local TLS-terminating reverse proxy) - a scheme/port mismatch, since Zed's own redirect is always plain http and nothing serves plain HTTP on 443 in that scenario. This code runs server-side (in the OAuth authorize API route), so once the redirect URI's hostname is confirmed loopback it now uses the OmniRoute process's own authoritative listening port via getRuntimePorts() (OMNIROUTE_PORT/PORT/DASHBOARD_PORT) instead of re-deriving it from the browser-observed scheme/port. Non-loopback (remote/LAN) redirect URIs still return null and fall back to the manual paste flow. Adds tests/unit/zed-hosted-loopback-port-derivation.test.ts (8 cases) covering the port-derivation logic directly, including the HTTPS-default-port mismatch scenario that motivated this fix, env-var precedence, IPv6 loopback, non-loopback/remote fallback, and buildAuthUrl's native_app_port wiring. Also rebaselines config/quality/file-size-baseline.json for OAuthModal.tsx's own growth from this PR's earlier commit (1134->1149 gate units) - legitimate zed-hosted callback wiring at the existing provider-switch chokepoint, not extractable without a broader modal decomposition (tracked in diegosouzapw#3501). The live Zed OAuth handshake itself (root -> /callback -> OAuthModal exchange against the real zed.dev endpoint) still needs a documented VPS smoke test per Hard Rule diegosouzapw#18; this fix covers the TDD-able port-derivation logic that motivated the change. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

@yourspraveen

Landed with the design call resolved per the owner's pick — **option 1**: the synced store is now endpoint-agnostic (persistDiscoveredModels and managedModelImport no longer drop non-chat models at write time), and chat selectability moved to read time (auto-pool expansion in autoStrategy applies filterChatSelectableModels; the models-route projection already had its chatOnly filter). Your discovery test now passes end-to-end (3/3): /api/show capabilities persist per connection and image/embedding requests route through the advertising host. Reconciliation notes: conflicted areas merged onto the current tip (adobe discovery import, requestedModel preflight signature, resolvedProvider fast-path coexists with the synced-route override — explicit resolution wins); carried base-red drains (#10055 memoization, #11071 test variants) dropped as already-landed; the managed-model-import exclusion test was propagated to the new contract (image/video models persist; the read filter still hides them from chat pickers — pinned by a new assertion). Full battery: 205/206 focused (the one red is a confirmed periodic-timer timing flake on the loaded devbox — 20/20 isolated), autoCombo vitest 30/30, combo suites 46/46, gates + typecheck clean. Thank you @yourspraveen — the capability probe + routing design was right; it just needed the store contract opened up. Fixes #11087.

…zapw#10055 drain already landed)

…k the release PR The living release PR #8875 was CONFLICTING, which makes GitHub skip EVERY pull_request workflow silently (no ci.yml, no semgrep, no DAST). Back-merging main restores a computable merge ref. Strategy `-s ours`: main is a stale snapshot of the release line (PR #11088 was merged into main from a release-tip base, dragging ~5094 files). All 7 main-only commits were verified as already represented on this branch: - #11088 ollama capability routing -> ported here as #11271 (6d4c484) - #11075 shared passthrough providers -> ported here as #11165 (92ef3c7) - #10055 getModelsDevPricing memoization -> present (modelsDevSync.ts) - #10026 hide health-check excluded models -> present and extended (catalog.ts) - /_tasks anchored gitignore hardening -> present (.gitignore:288) - nanoid/dompurify Dependabot bumps -> identical versions main-only files intentionally NOT carried over: - changelog.d/fixes/10286-gemini-3-5-flash-thinking.md + its regression test: the fix landed here as #10450 and was then deliberately superseded by 2764812 "eliminate Gemini 3.5 Flash". The test fails on this branch by design. - public/providers/hackclub.svg: provider removed here (migration 162). - docs/superpowers/**/2026-08-23-qdrant-*: planning artifacts belong in _tasks/ (AGENTS.md), never under docs/.

…nc-back step 2/2 The eighteen commits main carries beyond the cycle branch, and what each one became here: already in release/v3.8.51 by its own PR (no-op, verified by content): b090b60 / 026e1ca deps: nanoid 3.3.18 equal, dompurify 3.4.14 newer 918fba5 .gitignore: /_tasks already anchored 5f0a394 #10026 hide health-check-excluded models — same helper, 5 call sites c68cda7 #11075 shared passthrough providers — superseded by #11071/#11078 superseded, one piece kept: ca23eed #10055 memoize models.dev pricing — the cycle memoizes on the catalog cache version already; only the resetDbInstance() hook is ported, wired to that memo applied as-is: 8778ea7 stamp dist/BUILD_SHA before the npm provenance gate (#11721) aa52351 decouple the Bun image from the release manifest (#11724) 925feb2 let the bun digest artifact be absent (#11740) b65ef33 size the install-upgrade gate to a measured run 0ce2123 #11845 converge install/upgrade schemas (migration renumbered in the next commit: 163 collides with 163_radar_feed_cache_generated_at) b7c07ed #11855 install-upgrade gate on disk, not tmpfs 8e2fb04 #11864 drop *.nft.json from the npm tarball (413) dea6bb8 #11877 publish npm from a hosted runner (provenance 422) handled by the sync script that follows (CHANGELOG protocol): b4ec780 Release v3.8.50 — squash of content this branch already carries 5458026 / c44c0a2 CHANGELOG aggregation, stats and top-25 applied separately (its own commit, ten files): 65e8115 #11088 Ollama capability routing — a 5,094-file squash from a stale base; only the Ollama files are the change Every cherry-pick that touched a file this branch had also changed was resolved by hand and re-run through the tests both sides own for it.

The port destabilized tests/unit/modelsDevSync-extended.test.ts (6/14 with it, 18/2 without; 20/0 on a pristine release/v3.8.50). The cycle's own memo, keyed on the catalog cache version, stays as it was; the remaining failures predate this sync and are tracked separately.

…osouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>

…gosouzapw#10307) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(ops): Docker HEALTHCHECK probes /healthz not deep monitoring /api/monitoring/health does a SQLite ping and more. When the event loop is busy the official image HEALTHCHECK (5s timeout) marks the container Unhealthy and orchestrators restart the only replica mid-session. * fix(ops): keep healthcheck PR scoped to the /healthz probe Drop the stray catalog ghost-model exclusion that leaked into this branch from main (already covered upstream). Restore catalog.ts to the release version so the PR contains only the Docker HEALTHCHECK /healthz fix, its tests, and the changelog entry. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: adevwithpurpose <adevwithpurpose@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…iegosouzapw#10299) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(models): honor MODELS_DEV_SYNC_ENABLED=0 over dashboard settings The file header already advertised this env var but nothing read it. When catalog/compression pin the event loop, the dashboard (same process) cannot turn models.dev sync off. Let 0/false/off win over sqlite so an operator can recover with env + restart. Skip getModelsDevPricing SQL scans while the kill switch is set. * fix(models): restore prettier formatting after base merge Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> * test(models): cover env kill switch during live settings updates Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: adevwithpurpose <adevwithpurpose@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

diegosouzapw#10356) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(providers): remove invalid CodeBuddy CN glm-4.7 and add hy3 (0.0x credit) Swap the GLM-4.7 model for the Hunyuan hy3 model in the codebuddy-cn registry, keep the catalog at 15 models, and update the matching provider test expectations. Regenerated the auto-generated provider reference doc. --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…souzapw#10306) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(sse): keep Codex quota headers under the forwarding budget The 768-byte cap plus priority-3 for any name that does not contain "ratelimit" dropped x-codex-*-used-percent / reset / credits on every stream. x-codex-turn-state (314 bytes) ate the budget. Raise the cap, treat Codex quota headers as rate-limit priority, and do not forward turn-state. --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>

…ed budget) (diegosouzapw#10253) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(api): scale pool usage snapshot limits by member count (summed budget) --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…d port (diegosouzapw#10517) * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (diegosouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * Hide health-check excluded models from /v1/models catalog (diegosouzapw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> * fix(models): memoize getModelsDevPricing (event loop / healthz) (diegosouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> * fix(oauth): route Zed hosted sign-in callback back to the dashboard port Zed's native-app sign-in always redirects the browser to the loopback port sent as native_app_port (hardcoded default 58443), where nothing listens: the browser shows "site can't be reached" and the login looks broken even though the token is in the URL. The manual paste fallback was broken too - handleManualSubmit requires a ?code= param that Zed's callback (user_id + access_token) never carries, so the flow could never complete. - zed-hosted: derive native_app_port from the dashboard's own loopback port so the redirect lands back on OmniRoute; remote/LAN origins keep the old default port and the paste flow - app root: forward ?user_id=...&access_token=... to the /callback relay instead of dropping the query string on the /dashboard redirect - /callback relay: recognize the Zed payload (no code param) and relay the full URL as the exchange payload; allow postMessage to both loopback spellings (localhost/127.0.0.1) of the same port - OAuthModal: zed-hosted popup auto-completes on true localhost; the manual paste path passes the full URL through to the exchange instead of erroring with "No authorization code found" - manual input panel: zed-hosted-specific placeholder and hint - tests: extend the postMessage scope guard with the loopback same-port trusted origins * changelog: fragment for diegosouzapw#10517 * fix(oauth): derive Zed native_app_port from server config, not browser scheme/port resolveDashboardLoopbackPort() previously re-derived the dashboard's loopback port from the browser-supplied redirectUri (window.location.port || protocol === "https:" ? "443" : "80"), which produced http://127.0.0.1:443/ native-app redirects when the dashboard was reached over HTTPS on its implicit default port (e.g. behind a local TLS-terminating reverse proxy) - a scheme/port mismatch, since Zed's own redirect is always plain http and nothing serves plain HTTP on 443 in that scenario. This code runs server-side (in the OAuth authorize API route), so once the redirect URI's hostname is confirmed loopback it now uses the OmniRoute process's own authoritative listening port via getRuntimePorts() (OMNIROUTE_PORT/PORT/DASHBOARD_PORT) instead of re-deriving it from the browser-observed scheme/port. Non-loopback (remote/LAN) redirect URIs still return null and fall back to the manual paste flow. Adds tests/unit/zed-hosted-loopback-port-derivation.test.ts (8 cases) covering the port-derivation logic directly, including the HTTPS-default-port mismatch scenario that motivated this fix, env-var precedence, IPv6 loopback, non-loopback/remote fallback, and buildAuthUrl's native_app_port wiring. Also rebaselines config/quality/file-size-baseline.json for OAuthModal.tsx's own growth from this PR's earlier commit (1134->1149 gate units) - legitimate zed-hosted callback wiring at the existing provider-switch chokepoint, not extractable without a broader modal decomposition (tracked in diegosouzapw#3501). The live Zed OAuth handshake itself (root -> /callback -> OAuthModal exchange against the real zed.dev endpoint) still needs a documented VPS smoke test per Hard Rule diegosouzapw#18; this fix covers the TDD-able port-derivation logic that motivated the change. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@outlook.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> Co-authored-by: ritheshcn25 <rithesh.chandran@snb.ca> Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com> Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…osouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>

@yourspraveen

Landed with the design call resolved per the owner's pick — **option 1**: the synced store is now endpoint-agnostic (persistDiscoveredModels and managedModelImport no longer drop non-chat models at write time), and chat selectability moved to read time (auto-pool expansion in autoStrategy applies filterChatSelectableModels; the models-route projection already had its chatOnly filter). Your discovery test now passes end-to-end (3/3): /api/show capabilities persist per connection and image/embedding requests route through the advertising host. Reconciliation notes: conflicted areas merged onto the current tip (adobe discovery import, requestedModel preflight signature, resolvedProvider fast-path coexists with the synced-route override — explicit resolution wins); carried base-red drains (diegosouzapw#10055 memoization, diegosouzapw#11071 test variants) dropped as already-landed; the managed-model-import exclusion test was propagated to the new contract (image/video models persist; the read filter still hides them from chat pickers — pinned by a new assertion). Full battery: 205/206 focused (the one red is a confirmed periodic-timer timing flake on the loaded devbox — 20/20 isolated), autoCombo vitest 30/30, combo suites 46/46, gates + typecheck clean. Thank you @yourspraveen — the capability probe + routing design was right; it just needed the store contract opened up. Fixes diegosouzapw#11087.

…k the release PR The living release PR diegosouzapw#8875 was CONFLICTING, which makes GitHub skip EVERY pull_request workflow silently (no ci.yml, no semgrep, no DAST). Back-merging main restores a computable merge ref. Strategy `-s ours`: main is a stale snapshot of the release line (PR diegosouzapw#11088 was merged into main from a release-tip base, dragging ~5094 files). All 7 main-only commits were verified as already represented on this branch: - diegosouzapw#11088 ollama capability routing -> ported here as diegosouzapw#11271 (ec959d8) - diegosouzapw#11075 shared passthrough providers -> ported here as diegosouzapw#11165 (4813c32) - diegosouzapw#10055 getModelsDevPricing memoization -> present (modelsDevSync.ts) - diegosouzapw#10026 hide health-check excluded models -> present and extended (catalog.ts) - /_tasks anchored gitignore hardening -> present (.gitignore:288) - nanoid/dompurify Dependabot bumps -> identical versions main-only files intentionally NOT carried over: - changelog.d/fixes/10286-gemini-3-5-flash-thinking.md + its regression test: the fix landed here as diegosouzapw#10450 and was then deliberately superseded by bc825a1 "eliminate Gemini 3.5 Flash". The test fails on this branch by design. - public/providers/hackclub.svg: provider removed here (migration 162). - docs/superpowers/**/2026-08-23-qdrant-*: planning artifacts belong in _tasks/ (AGENTS.md), never under docs/.

…nc-back step 2/2 The eighteen commits main carries beyond the cycle branch, and what each one became here: already in release/v3.8.51 by its own PR (no-op, verified by content): 7124dd3 / bae33e2 deps: nanoid 3.3.18 equal, dompurify 3.4.14 newer ceb8e3e .gitignore: /_tasks already anchored bf87c7d diegosouzapw#10026 hide health-check-excluded models — same helper, 5 call sites 3816ade diegosouzapw#11075 shared passthrough providers — superseded by diegosouzapw#11071/diegosouzapw#11078 superseded, one piece kept: b735371 diegosouzapw#10055 memoize models.dev pricing — the cycle memoizes on the catalog cache version already; only the resetDbInstance() hook is ported, wired to that memo applied as-is: a93d123 stamp dist/BUILD_SHA before the npm provenance gate (diegosouzapw#11721) dd329d7 decouple the Bun image from the release manifest (diegosouzapw#11724) a5e649b let the bun digest artifact be absent (diegosouzapw#11740) e9045c4 size the install-upgrade gate to a measured run f5addae diegosouzapw#11845 converge install/upgrade schemas (migration renumbered in the next commit: 163 collides with 163_radar_feed_cache_generated_at) a38590e diegosouzapw#11855 install-upgrade gate on disk, not tmpfs 8588804 diegosouzapw#11864 drop *.nft.json from the npm tarball (413) 28bde09 diegosouzapw#11877 publish npm from a hosted runner (provenance 422) handled by the sync script that follows (CHANGELOG protocol): fc15eef Release v3.8.50 — squash of content this branch already carries 2b80128 / 4398260 CHANGELOG aggregation, stats and top-25 applied separately (its own commit, ten files): 837b36a diegosouzapw#11088 Ollama capability routing — a 5,094-file squash from a stale base; only the Ollama files are the change Every cherry-pick that touched a file this branch had also changed was resolved by hand and re-run through the tests both sides own for it.

The port destabilized tests/unit/modelsDevSync-extended.test.ts (6/14 with it, 18/2 without; 20/0 on a pristine release/v3.8.50). The cycle's own memo, keyed on the catalog cache version, stays as it was; the remaining failures predate this sync and are tracked separately.

Copilot AI lite review requested due to automatic review settings August 10, 2026 23:22

RaviTharuma requested a review from diegosouzapw as a code owner August 10, 2026 23:22

This was referenced Aug 10, 2026

fix(api): GET /v1/models pegs event loop — getModelsDevPricing re-reads per model #9685

Closed

fix(ops): /healthz (and other HTTP) times out while event loop is busy (k8s probes flap) #10052

Closed

Copilot started reviewing on behalf of RaviTharuma August 10, 2026 23:25 View session

Copilot AI reviewed Aug 10, 2026

View reviewed changes

diegosouzapw merged commit ca23eed into diegosouzapw:main Aug 13, 2026
3 checks passed

diegosouzapw pushed a commit to yourspraveen/OmniRoute that referenced this pull request Aug 23, 2026

board diegosouzapw#11088: modelsDevSync test at tip (carried diegosou…

71cf237

…zapw#10055 drain already landed)

diegosouzapw mentioned this pull request Aug 23, 2026

🔴 main branch not green #9282

Closed

cursor Bot mentioned this pull request Sep 3, 2026

[BUG] GET /api/monitoring/health live probes starve /healthz on official 3.8.50 #12532

Closed

RaviTharuma deleted the fix/healthz-nonblocking branch September 23, 2026 19:38

Navigation Menu

Uh oh!

fix(models): memoize getModelsDevPricing (event loop / healthz) - #10055

fix(models): memoize getModelsDevPricing (event loop / healthz)#10055
diegosouzapw merged 2 commits into
diegosouzapw:mainfrom
RaviTharuma:fix/healthz-nonblocking

RaviTharuma commented Aug 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

RaviTharuma commented Aug 10, 2026

Summary

Change

Why not a separate health server?

Test plan

Security

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Verification (custom)

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants