fix(opencode-plugin): respect log level in provider.models() catalog path (#8982)

.env.example

@@ -229,6 +229,15 @@ PORT=20128
 # unaffected by this dev-only flag).
 OMNIROUTE_USE_TURBOPACK=1
 
+# Disable systemd sd_notify (Type=notify / WatchdogSec=) even when running
+# under a systemd unit with NOTIFY_SOCKET set.
+# Used by: scripts/dev/systemd-notify.mjs. Set to 1 to disable.
+# OMNIROUTE_DISABLE_SD_NOTIFY=1
+
+# Injected by systemd when running under a service unit (sd_notify protocol).
+# Read by scripts/dev/systemd-notify.mjs — never set this yourself.
+# NOTIFY_SOCKET=/run/systemd/notify
+
 # Skip the SQLite integrity health check on startup (faster boot on large DBs).
 # Used by: src/lib/db/core.ts, src/lib/db/healthCheck.ts. Set to 1 to skip.
 # OMNIROUTE_SKIP_DB_HEALTHCHECK=1
@@ -408,6 +417,15 @@ ALLOW_API_KEY_REVEAL=false
 # by OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT and the heap-pressure shed instead. Set a positive
 # value only on memory-constrained deployments that need a hard ceiling.
 # OMNIROUTE_CHAT_HARD_MAX_MESSAGES=0
+
+# Skip OmniRoute's local context-window and max-input-token check for direct
+# single-model requests. Default: false (dangerous opt-in).
+# The upstream provider still enforces its real limits, so enabling this can
+# replace an early OmniRoute 400 with an upstream context-length error.
+# Prompt compression and the model's own output-token cap remain active.
+# Also configurable from Dashboard > Settings > Feature Flags; no restart is
+# required. Used by: src/shared/utils/featureFlags.ts and open-sse/handlers/chatCore.ts.
+# DISABLE_CONTEXT_WINDOW_CHECKS=false
 # How long a heavy request waits for heavyweight capacity before a retryable 503.
 # A short bounded wait serializes agent bursts instead of an instant 503; 0 = instant.
 # Default 2000 (2s).
@@ -696,6 +714,11 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # ALL_PROXY=socks5://127.0.0.1:7890
 # NO_PROXY=localhost,127.0.0.1
 
+# Pin the echo-IP target used by proxy egress probes. Unset, the probe tries
+# api64.ipify.org then api4.ipify.org so IPv4-only tunnels are not reported dead.
+# Used by: src/lib/proxyEchoTarget.ts.
+# OMNIROUTE_PROXY_ECHO_URL=https://api4.ipify.org?format=json
+
 # Max concurrent sockets per cached HTTP/SOCKS proxy dispatcher.
 # Long-lived SSE streams such as Codex /v1/responses need more than one
 # connection when multiple requests share the same account-level proxy.
@@ -876,13 +899,21 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Set to 0/false/off to skip compression entirely. Default: rtk
 # OMNIROUTE_MCP_DESCRIPTION_COMPRESSION=rtk
 
+# Abort budget (ms) for MCP-server internal management reads (health, resilience,
+# combos, quota, usage). Default: 10000. Used by: open-sse/mcp-server/fetchTimeout.ts
+# OMNIROUTE_MCP_FETCH_TIMEOUT_MS=10000
+
+# Abort budget (ms) for MCP hops that wait on a provider (route_request, web_search,
+# web_fetch). Default: 60000. Used by: open-sse/mcp-server/fetchTimeout.ts
+# OMNIROUTE_MCP_UPSTREAM_TIMEOUT_MS=60000
+
 # Model catalog sync interval in hours.
 # Used by: src/shared/services/modelSyncScheduler.ts — periodic model refresh.
 # Default: 24
 # MODEL_SYNC_INTERVAL_HOURS=24
 
 # Provider limits sync interval in minutes (rate limit windows, quotas).
-# Used by: src/server-init.ts — polls provider health endpoints.
+# Used by: src/lib/usage/providerLimits.ts — polls provider health endpoints.
 # Default: 70
 PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES=70
 
@@ -1033,6 +1064,10 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: src/lib/db/core.ts::getDbHealthCheckIntervalMs().
 #OMNIROUTE_DB_HEALTHCHECK_INTERVAL_MS=21600000
 
+# WAL truncate cadence override (ms).  Set to 0 to disable.  Default: 21600000 (6h).
+# Used by: src/lib/db/core.ts::getWalTruncateIntervalMs().
+#OMNIROUTE_WAL_TRUNCATE_INTERVAL_MS=21600000
+
 # Skip the Redis-backed auth cache used by API key lookups (forces DB reads).
 # Used by: src/lib/db/apiKeys.ts.  Set to 1 to disable.  Default: enabled.
 #OMNIROUTE_DISABLE_REDIS_AUTH_CACHE=0
@@ -1348,6 +1383,14 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # FETCH_BODY_TIMEOUT_MS=600000       # Time to receive full response body
 # FETCH_CONNECT_TIMEOUT_MS=30000     # TCP connection establishment (default: 30s)
 # FETCH_KEEPALIVE_TIMEOUT_MS=4000    # Keep-alive socket idle timeout (default: 4s)
+# OMNIROUTE_DIRECT_HEADERS_TIMEOUT_MS=30000  # Bounded response-start window per direct
+#                                     # (no-proxy) attempt (#10214). A silently-dropped
+#                                     # pooled keep-alive socket surfaces no transport
+#                                     # error, so without this bound a direct request can
+#                                     # stall until undici's headersTimeout (600s) or the
+#                                     # caller's deadline; on expiry the request retries
+#                                     # once on a fresh no-keep-alive socket. 0 disables
+#                                     # the bound (default: 30000 = 30s).
 
 # Default timeout (ms) for src/shared/utils/fetchTimeout.ts. Acts as the
 # fallback when FETCH_TIMEOUT_MS is unset. Default: 120000 (2 min).
@@ -1402,6 +1445,14 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # OMNIROUTE_PPLX_TLS_TIMEOUT_MS=30000
 # OMNIROUTE_PPLX_TLS_GRACE_MS=10000
 
+# ── Perplexity web: built-in-search hint ──
+# Used by: open-sse/executors/perplexity-web/protocol.ts — appends "You have
+# built-in web search. Answer questions directly using search results." to the
+# caller's system message. Off by default: Perplexity's answer engine searches
+# anyway, and for coding clients the sentence leaks into replies as
+# meta-commentary. Set to 1/true/yes/on to restore the old behavior.
+# OMNIROUTE_PPLX_SEARCH_HINT=0
+
 # ── Grok web TLS sidecar (Chrome-fingerprinted client) ──
 # Used by: open-sse/services/grokTlsClient.ts — wire-level timeout for the
 # bogdanfinn/tls-client koffi binding and the JS-side grace window layered on
@@ -1975,6 +2026,16 @@ APP_LOG_TO_FILE=true
 # Reachability probe target for the scheduler and the auto-test endpoint.
 # Point it at an internal/self-hosted URL to avoid the public default.
 # PROXY_HEALTH_TEST_URL=https://httpbin.org/ip
+# Probes started at once per batch, for the scheduler and the auto-test endpoint.
+# Floored at 1 and capped at 50. Default: 10.
+# PROXY_HEALTH_TEST_CONCURRENCY=10
+# Delay in ms between two probe departures inside a batch. Without it the whole batch
+# leaves at once and a shared egress IP can trip a rate-limited target. 0 disables the
+# spacing; capped at 5000. Default: 100.
+# PROXY_HEALTH_TEST_STAGGER_MS=100
+# Set "false" to stop probing the real host of a proxy's assigned provider (GET /models,
+# no API key) and always use the generic target above instead. Default: enabled.
+# PROXY_HEALTH_USE_PROVIDER_TARGET=true
 # Set "true" to let the scheduler auto-remove proxies after repeated failures.
 # PROXY_AUTO_REMOVE=false
 # Consecutive failures before an auto-remove fires. Default: 3.
@@ -2117,6 +2178,19 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: detect local install, else pin.
 # CURSOR_AGENT_CLI_VERSION=2026.07.08-0c04a8a
 
+# Path to the Cursor Agent binary used for image generation.
+# Used by: open-sse/handlers/imageGeneration/providers (CURSOR_IMAGE.md).
+# CURSOR_AGENT_BIN=/path/to/agent
+
+# Cursor image-generation wall clock (ms). Default: 210000.
+# CURSOR_IMG_TIMEOUT_MS=210000
+
+# Shared-seat concurrency gate for Cursor image jobs. Default: 2.
+# CURSOR_IMG_MAX_CONCURRENT=2
+
+# Override Cursor CLI --model for image jobs. Default: request model / auto.
+# CURSOR_IMG_MODEL=auto
+
 # Cursor Agent CLI data directory override (versions live under <dir>/versions/).
 # Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: ~/.local/share/cursor-agent (unix)
 # or %LOCALAPPDATA%\cursor-agent (win32). Official agent CLI also honors this var.

.github/dependabot.yml

@@ -50,13 +50,13 @@ updates:
       # bumps; majors here need their own PR and a deliberate migration review.
       - dependency-name: "ioredis"
         update-types: ["version-update:semver-major"]
-      # @huggingface/transformers is HARD-PINNED at 3.5.2 (exact, no caret) — FROZEN.
-      # It is load-bearing for the LLMLingua ONNX compression engine (open-sse/services/
-      # compression/engines/llmlingua/ — worker.ts pins @huggingface/transformers@3.5.2)
-      # and for local memory embeddings (src/lib/memory/embedding/transformersLocal.ts),
-      # and was VPS-validated at 3.5.2 (#4014). 4.x breaks both, and even 3.x minors must
-      # be re-validated on the VPS — so freeze ALL auto-bumps (no update-types = ignore
-      # every version). Migrate it intentionally, not via dependabot (#4050).
+      # @huggingface/transformers is VPS-validated at ^4.2.0 (migrated intentionally in
+      # #9962). It is load-bearing for the LLMLingua ONNX compression engine (open-sse/
+      # services/compression/engines/llmlingua/ — @atjsh/llmlingua-2@2.0.5 peers on
+      # "@huggingface/transformers": "^3.5.2 || ^4.0.0") and for local memory embeddings
+      # (src/lib/memory/embedding/transformersLocal.ts). Further majors must be re-validated
+      # on the VPS — so keep auto-bumps frozen (no update-types = ignore every version).
+      # Migrate it intentionally, not via dependabot (#4050).
       - dependency-name: "@huggingface/transformers"
 
   - package-ecosystem: "github-actions"

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           category: "/language:javascript-typescript"

.github/workflows/docker-publish.yml

@@ -372,7 +372,7 @@ jobs:
       - name: Upload Trivy SARIF to Security tab
         if: needs.prepare.outputs.version != 'main'
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4.37.6
+        uses: github/codeql-action/upload-sarif@v4.37.7
         with:
           sarif_file: trivy-results.sarif
           category: trivy-image

.github/workflows/radar-export.yml

@@ -0,0 +1,64 @@
+# Publica o export estável do catálogo consumido pelo OmniRoute Radar numa URL
+# fixa (asset de release `radar-export-latest`), para o servidor privado do Radar
+# (1 GB RAM, nunca clona/builda o OmniRoute) baixá-lo via `RADAR_EXPORT_URL` em
+# vez de depender do snapshot gravado no deploy. Fonte: scripts/release/radar-export.mjs.
+#
+# A URL estável resultante (definir em RADAR_EXPORT_URL no .env do radar-server):
+#   https://github.com/diegosouzapw/OmniRoute/releases/download/radar-export-latest/export-omniroute.json
+name: Radar Export
+
+on:
+  workflow_dispatch: # o operador pode publicar sob demanda (de qualquer ref)
+  push:
+    branches: [main] # produção: só o catálogo do main clobra o asset estável
+    paths:
+      - open-sse/config/freeModelCatalog.data.ts
+      - open-sse/config/freeModelCatalog.ts
+      - open-sse/config/providerRegistry.ts
+      - open-sse/config/providers/**
+      - scripts/release/radar-export.mjs
+      - .github/workflows/radar-export.yml
+  schedule:
+    - cron: "17 6 * * 1" # semanal (segunda 06:17 UTC): mantém geradoEm/proveniência frescos
+
+permissions:
+  contents: read
+
+concurrency:
+  group: radar-export-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CI_NODE_VERSION: "24"
+
+jobs:
+  publish-export:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # gh release upload — clobra o asset estável do export
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false # publish usa GH_TOKEN via gh release, não a credencial do checkout
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - name: Generate catalog export with provenance
+        run: node --import tsx/esm scripts/release/radar-export.mjs "$RUNNER_TEMP/export-omniroute.json"
+      - name: Publish to the stable release asset
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="radar-export-latest"
+          # Cria o release estável na primeira vez; nas seguintes só re-anexa o asset.
+          if ! gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release create "$TAG" \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "Radar catalog export (rolling)" \
+              --notes "Export estável do catálogo OmniRoute para o Radar. Atualizado automaticamente; NÃO é um release de versão do produto." \
+              --latest=false
+          fi
+          gh release upload "$TAG" "$RUNNER_TEMP/export-omniroute.json" --repo "$GITHUB_REPOSITORY" --clobber