Conversation
…estored credits Phase 0a of /generate-release. Measured commit<->CHANGELOG coverage over the real cycle range (2c62333..HEAD, 933 non-merge commits) instead of the last tag: 180 merged PRs had no bullet at all (they landed without a changelog.d fragment) and a further 19 were invisible because the merge-train landed them under a generic 'Train 1D: merge via --admin' subject that carries no PR reference. - +200 bullets, all with PR back-reference and author attribution (1179 -> 1379) - 🙌 Contributors 156 -> 178; credits @terrafirmbot-source for diegosouzapw#7904, which shipped through the conflict-resolved diegosouzapw#8685 without any attribution - closed-PR credit audit over the 32 human PRs closed unmerged this cycle: 12 had already landed under the author's own follow-up PR and were verified credited - rollup bullet for the direct release-branch maintenance (merge-train landings, ratchet re-pins, base-red sweeps) that carries no PR of its own - [3.8.49] header dated 2026-07-28 (was TBD) in the root file and the 42 i18n mirrors Coverage after: 0 commits uncovered.
…drift Pre-flight sweep (Phase 0). Test suites ran on the dedicated 32-core box so the self-inflicted load of `node --test` could not fabricate timing flakes. Base-reds fixed (all real, all from merged cycle PRs that did not update their characterization tests): - providers-constants-split / quota-plan-registry / provider-translate-path GOLDEN: diegosouzapw#8861 added the Xiaomi MiMo Token Plan provider, so APIKEY_PROVIDERS is 195 (was 194), knownProviders() is 12 (was 11) and the translate-path snapshot gains one purely additive entry. Counts aligned to the shipped catalog, never relaxed. - agent-skills-content: skills/config-codex-cli/ was added by diegosouzapw#8709 with a custom block, so the custom-block set is 13, not 12. - chatcore-compression-integration: diegosouzapw#8595/diegosouzapw#8560 deliberately decoupled REACTIVE context compaction from the `enabled` master switch, so a body above 70% of the window is pruned even with compression off. The test was sized above that threshold, which made it assert against intended behavior; it now stays below it and keeps testing the invariant it was written for (resolveBasePlan short-circuits to "off" before reading comboOverrides). Static gates: - 3 shellcheck directives were malformed (`# shellcheck disable=SC2086 — text`; the em-dash makes shellcheck reject the whole directive as SC1125) in ci.yml and nightly-release-green.yml — the comment now sits on its own line. - gitleaks: 2 new generic-api-key false positives allowlisted with justification — a localStorage key for the sponsor banner (diegosouzapw#8723) and the PUBLIC Adobe Firefly web x-api-key, whose only literals are in JSDoc (the runtime reads it through resolvePublicCred, per Hard Rule diegosouzapw#11). secretFindings back to 0. - zizmor 176 -> 189 and bundleSize 6762 -> 7666 rebaselined with the measurement and the reason; both are ordinary cycle drift absorbed at release. Environment-dependent failures classified out, not silenced: the two tproxy tests assert the native addon is unavailable/unprivileged and therefore fail when the suite runs as root on the build box (they pass as a normal user), and the consoleInterceptor rate-limit test is a 4s-timing flake under load (6/6 isolated).
…put-item contract Fifth and last base-red of the v3.8.49 pre-flight. diegosouzapw#8507 (diegosouzapw#8083) deliberately sets `status: "completed"` on Responses input items so strict upstream validators accept them; codex-chat-reasoning-http-e2e still asserted the pre-diegosouzapw#8507 shape, so it failed against intended behavior. Expectation updated with the reason inline — the assertion is not relaxed, it now pins the current contract. The test was never reached in the first pre-flight sweep (the run was interrupted during the integration phase, and this file sorts after the one that failed).
Phase 1 step 6b. Swept the cycle's 284 New Features bullets against the existing docs before writing anything: nearly every large theme (Kimi, xAI OAuth, session affinity, bun:sqlite, Firecrawl, Opus 5, omniglyph, GCF v3.2, homologation suite) was already covered. Six real gaps were left undocumented by the PRs that shipped them, each verified in source before being written up: - CredentialMaskerGuardrail (diegosouzapw#7683) is registered in guardrails/registry.ts but the GUARDRAILS table listed only 3 of the 4 guardrails - the cacheAffinity scoring factor and the cache-optimized combo strategy (diegosouzapw#8008): the docs still said 12 factors / 18 strategies, the code has 13 / 19 - the optional dashboard OIDC login gate (diegosouzapw#6973) — /api/auth/oidc/{login,callback} had no mention in AUTHZ_GUIDE - GET /api/usage/cache-health (diegosouzapw#8827) and GET /api/usage/model-latency-stats (diegosouzapw#6873) were missing from the API reference README "What's New" gains one bullet (routing transparency) and merges two others rather than growing a second changelog. PROVIDER_REFERENCE regenerated with the generator (Firecrawl reclassified to Search, Xiaomi MiMo added by diegosouzapw#8861). check:docs-all green: 134 docs, 813 internal links, no fabricated API/env/CLI references. Known pre-existing drift left alone and reported: stale nominal counts in ARCHITECTURE/CODEBASE_DOCUMENTATION (soft), the 9-factor mentions scattered in AUTO-COMBO, and the auto-combo diagram SVG (the renderer needs a browser this environment does not have — the .mmd source is updated and the .md says so).
The release PR was `mergeable=CONFLICTING`, and GitHub cannot compute a merge ref in that state — so NO pull_request workflow was firing for diegosouzapw#7076 at all. Neither pushing nor flipping draft->ready changes that; the branch has to become mergeable first. main carried 13 commits that never reached this branch (post-v3.8.48 hotfixes, Dependabot overrides, Mergify config, the cliproxy exposure controls). Every one of them is already represented here by content — verified before resolving, not assumed: the npm overrides match field by field, the provider-plugin-manifest route exists, the CodeQL static-body fix in the codex e2e bridge is present, README already uses local SVG flags, .mergify.yml is in place. So the 90 conflicts are textual duplicates of work that landed on both sides, and `--ours` is the correct resolution. Resolved by hand where a wrong auto-resolve would be unrecoverable: - quality-baseline.json: main's diegosouzapw#7347 coverage tightening was ALREADY on this branch, so nothing is lost by taking ours. The two real conflicts keep the branch's values — coverage.functions 86.42 (deliberately loosened by diegosouzapw#7625, which added two functions the shards do not exercise; taking main's 86.44 would red the gate for the exact documented reason) and zizmorFindings 189 (main's 175 predates this cycle's drift). - CHANGELOG.md auto-merged: verified 1379 bullets in [3.8.49], 234 in [3.8.47] and 178 contributors — the counts are the only proof the merge did not eat bullets. - file-size-baseline.json: confirmed the 1114 re-pin survived. The merge also resurrected 191 changelog.d fragments that main still holds because main only ever receives the squashed release. All 191 were confirmed already present in the [3.8.49] section — by PR reference where they carry one, by normalized text match for the 25 that do not — and removed, so the next aggregation cannot duplicate them.
Every finding from the first full ci.yml run on the release PR, fixed or justified together so a single re-push clears the board. Lint / check:route-validation:t06 — three routes read request.json() with no visible Zod validation. The two proxy-subscriptions routes validated with a hand-rolled parsePayload(); they now use real Zod schemas (src/lib/proxySubscription/schema.ts) reproducing the same acceptance rules, error strings and status codes. chat/completions is the proxy's hottest path and parses the body ONCE on purpose (diegosouzapw#4380 OOM crash-loop), so it now safeParses the ALREADY-PARSED object against a deliberately permissive structural schema — proven not to change behavior: absent model and model:null still pass through, role "developer" still reaches 200, a ~300 KB payload is accepted, and the body is still read exactly once. 25 new tests. i18n UI value drift — 13 English strings rewritten during the cycle left stale translations in up to 41 locales (317 pairs). Eleven are genuine rewrites and now carry the pipeline's __MISSING__:<english> marker so the runtime serves corrected English until translation catches up; vi forbids that marker by test, so it got a real translation. PR Test Policy — 33 files flagged. Each was verified against the SOURCE, not the diff: 26 assert reductions are legitimate (mostly the diegosouzapw#7866 Qwen OAuth provider removal and the diegosouzapw#8013 Antigravity refactor deleting the surface under test) and are allowlisted with the PR and the evidence; 5 deleted files have verified replacements. One was NOT legitimate: diegosouzapw#7528's GraphQL->WebSocket migration dropped four muse-spark continuation scenarios whose logic is still live — connection isolation, cache eviction after a failed turn (the commit itself says "was missing"), parallel-chat cache collision, and the empty-content guard. All four are restored against the new transport and each was verified to fail when the corresponding production mechanism is broken. Quality Ratchet / openapiCoverage — 36.6% against a baseline of 38: the cycle added routes faster than the spec. Eight real endpoints are now documented from their route.ts (usage cache-health and model-latency-stats, the two OIDC endpoints, and the five proxy-subscriptions paths), bringing it to 38.1%. Quality Gates (Extended) / zizmor — the runner measures 190 where the devbox measures 189 on the same commit, a delta already recorded in this baseline's history. Baselined to the runner's number. Also: the driverFactory better-sqlite3 guard moved from a mid-body t.skip() to a declared { skip: <condition> } test option. Same behavior for the optional native dependency, but the skip now shows up in the report and is distinguishable from a test.skip() that silences a test outright. Verified under both runners: 15/15 on Node, 14/14 on Bun. SonarCloud Code Analysis stays red and is not a blocker: sonar.qualitygate.wait=false since diegosouzapw#7038 makes the job informative, the built-in gate cannot be swapped on the FREE plan, and main has no branch protection.
test-masking — I had missed one of the 34 flagged files: my first pass grepped only paths under tests/, so open-sse/services/__tests__/tierResolver.test.ts was invisible. Same diegosouzapw#7866 cause as the other eight qwen-driven reductions: the "classifies Qwen as free" case and qwen's entry in the batch list went with the removed provider, and the batch indices dropped from 10 to 9 (61→59). Allowlisted with that evidence. dast-smoke — all four Schemathesis findings are on the two OIDC endpoints documented in the previous commit, and none is a defect. /api/auth/oidc/* is a BROWSER redirect flow: it answers 302 to the IdP and 302 back to /login?oidc_error=... on every failure, which Schemathesis reads as "accepted a schema-violating request", and it answers 400 when OIDC is not configured, which it reads as "rejected a schema-compliant request". Keeping the endpoints in the spec is right — operators need them, and they are what brought openapi coverage back over the baseline — so the flow is excluded from the fuzz instead, with the reason inline in the workflow. The rest of /api/auth and /api/keys stays in scope.
…nting it The anti-test-masking gate greps text, not code: my explanation of WHY the better-sqlite3 guard moved out of the test body spelled the runner API out literally, and those two mentions inside a comment were counted as two new skip markers — the exact signal the previous commit set out to clear. Same explanation, phrased without the call syntax. Verified with the gate's own exported helpers against the merge-base: 0 modified-file violations, 0 deletion violations. Test still 15/15.
… the i18n test seam The Vitest job is a BLOCKING gate that had not run to completion once in this whole release: rounds 1-3 cancelled it via cancel-in-progress on each successive fix push, so its red was indistinguishable from green. Round 4 finally ran it and the suite was broken cycle-wide. Root cause of the suite: diegosouzapw#7935 instrumented ~180 shared/dashboard components with next-intl's useTranslations/useLocale without updating the tests that mount them, so every one of them threw "context from NextIntlClientProvider was not found". Fixed at the shared seam (tests/_setup/vitestUiPolyfills.ts) rather than per file: a translator built from the REAL en.json via next-intl's own createTranslator, memoized per namespace — the naive version returns a fresh function each call and any component whose useCallback/useEffect depends on t spins forever, which reads as a hang, not a failure. A local mock still wins over the default. 22 files fixed by the seam alone, 15 realigned to the real strings; no assert removed or weakened. Two production bugs the suite was hiding, both pre-existing and both with a failing regression test already in the tree: - RequestLoggerDetail crashed on a structured error object. diegosouzapw#7920 gave the component formatErrorForDisplay for exactly this case, then diegosouzapw#8213's combo-503 / cooldown checks went to the raw field and called .toLowerCase() on it. Both paths now use the helper. - The logs detail modal reopened on first close again. diegosouzapw#6830 fixed that by reading the deep-link id ONCE; the diegosouzapw#8354 page rewrite regressed it by reading the live searchParams every render, so the prop flips mid-session and re-fires the child's deep-link effect exactly as the modal closes. Frozen at mount again. Also tightens i18nUiCoverage 75.5 -> 99, which the ratchet demanded under --require-tighten: the metric genuinely improved as the async translation workflow paid off the debt that the v3.8.39/.44/.47 rebaselines had been recording. The collector subtracts placeholders, so this release's 317 __MISSING__ markers are already netted out of the 99. Two UI files still fail locally under 20-worker concurrency (combos-page-smoke, evals-tab-smoke) — cold-import flakes that pass isolated and with a larger timeout.
…ised test-e2e has `needs: [build]`, and the release PR's Build died on every round until now — so the 9-shard matrix produced ZERO signal for this whole cycle while ~200 PRs merged. The first successful Build surfaced four independent breakages, each traced to the commit that caused it: - providers-management (diegosouzapw#7361): the single-connection delete moved from window.confirm() to a ConfirmModal, so page.once("dialog") never fired and the DELETE was never sent (deleteCalls stayed 0). Click the modal instead. - providers-bailian-coding-plan (diegosouzapw#7882): the free-text Base URL field was deliberately replaced by a region step whose choice resolves the endpoint (global-sg -> coding-intl.dashscope, china-beijing -> coding.dashscope). Both cases rewritten against the region step; the invalid-URL case is unreachable from this modal now, so it covers the CN choice instead. - group-b-activity-feed: the stack-trace guard ran against page.content(), which embeds the serialized i18n payload — zenmux's "endpoint at /api/v1/chat/completions" is prose, not a leak. Assert on rendered innerText and require the :line:col every real stack frame carries. - navigation (diegosouzapw#8292): APP_ROUTE_PATTERN accepted only /login and /dashboard, but the new prefetch spec is the sole caller passing /home, so waitForURL never resolved and the retry loop burned the full 180s timeout. E2E is green on main (9/9 on 07-22 and 07-23), so all four are cycle regressions, not pre-existing debt. Tests only — no production code touched.
diegosouzapw#8292 fixed half the RSC prefetch storm: it added prefetch={false} to the sidebar's navigation and logo links, but /home — the landing route, and the one its own e2e guard visits — renders five more internal Links in the quick-start cards. First paint still fired 12 speculative RSC requests for /dashboard/{analytics,logs,providers,api-manager} and /docs. That PR shipped the test that would have caught this, but the test never got to its assertion: gotoDashboardRoute("/home") hung because APP_ROUTE_PATTERN accepted only /login and /dashboard, so the retry loop burned the whole 180s timeout with no assertion error. With that helper repaired in the previous commit, navigation.spec.ts finally ran and reported the 12 requests. Validated both ways, per Hard Rule diegosouzapw#18: - tests/unit/sidebar-prefetch-policy-8281.test.ts extended to /home — red on the parent commit (5 internal Links, 5 without prefetch={false}), green here. - the e2e assertion expect(speculativeRequests).toEqual([]) is the end-to-end guard; it is what surfaced the defect in the first place.
The prefetch fix in the parent commit tripped check:file-size — the frozen
budget for this file is 1377 lines and a naive fix measured 1391, because
`href` + `prefetch={false}` + `className` no longer fits Prettier's 100-column
budget, so three one-line <Link> elements each expanded to five.
Followed the gate's own first suggestion (extract/DRY) before touching the
baseline: the quick-start links repeated the same className literal four
times, and the docs link carried a 180-char one inline. Hoisting both into
INLINE_LINK / DOCS_LINK collapses five wrapped <Link> blocks back to a single
line each and removes the duplication — 1391 -> 1381.
The remaining +4 over the frozen budget is the five prefetch attributes
themselves, which cannot be expressed in fewer lines. Rebaselined to 1381
with the rationale recorded in file-size-baseline.json under
_rebaseline_2026_07_29_8281_home_quickstart_prefetch.
tests/unit/sidebar-prefetch-policy-8281.test.ts still passes (2/2): it matches
whole <Link ...> blocks, so it is indifferent to the wrapping and only checks
that every internal link opts out of prefetch.
Added Opper as an API-key gateway provider to OmniRoute. Five files changed: 1. `src/shared/constants/providers/apikey/gateways.ts` — new `opper` entry inserted immediately before `requesty` (same family: multi-model gateway, `passthroughModels: true`), matching the exact field shape of `requesty` and `openrouter`. 2. `open-sse/config/providers/registry/opper/index.ts` — new registry file using `buildOpenAiCompatibleRegistryEntry`, identical pattern to `requesty/index.ts`; base URL `https://api.opper.ai/v3/compat/chat/completions`, models URL `https://api.opper.ai/v3/compat/models`, empty static seed (live catalog via passthrough). 3. `open-sse/config/providers/index.ts` — import + REGISTRY key `opper` added adjacent to `requesty`. 4. `tests/unit/opper-provider.test.ts` — four unit tests mirroring `requesty-provider.test.ts`: catalog entry shape, registry entry shape, empty static seed, and passthrough model-id acceptance. 5. `changelog.d/features/opper-provider.md` — changelog fragment following the project's `changelog.d/` convention (never editing `CHANGELOG.md` directly).
…d golden snapshot
diegosouzapw
added a commit
that referenced
this pull request
Aug 26, 2026
Merged via /merge-batch (lote 2026-08-26, v3.8.51). Porta de #11538 com autoria original preservada — ver detalhes na descrição desta PR.
Owner
|
Obrigado pela contribuição! O fork da organização (opper-ai) não permite push de mantenedor, então não consegui enviar a correção de conflito diretamente ao seu branch. Recriei os 2 commits de valor real (adicionar o provider + logo/aggregator tag) com sua autoria preservada em #11629, que já foi mergeada em |
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…pw#11629) Merged via /merge-batch (lote 2026-08-26, v3.8.51). Porta de diegosouzapw#11538 com autoria original preservada — ver detalhes na descrição desta PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added Opper as an API-key gateway provider to OmniRoute. Five files changed:
src/shared/constants/providers/apikey/gateways.ts— newopperentry inserted immediately beforerequesty(same family: multi-model gateway,passthroughModels: true), matching the exact field shape ofrequestyandopenrouter.open-sse/config/providers/registry/opper/index.ts— new registry file usingbuildOpenAiCompatibleRegistryEntry, identical pattern torequesty/index.ts; base URLhttps://api.opper.ai/v3/compat/chat/completions, models URLhttps://api.opper.ai/v3/compat/models, empty static seed (live catalog via passthrough).open-sse/config/providers/index.ts— import + REGISTRY keyopperadded adjacent torequesty.tests/unit/opper-provider.test.ts— four unit tests mirroringrequesty-provider.test.ts: catalog entry shape, registry entry shape, empty static seed, and passthrough model-id acceptance.changelog.d/features/opper-provider.md— changelog fragment following the project'schangelog.d/convention (never editingCHANGELOG.mddirectly).Summary
Related Issues
Validation
Choose the change type and focused loop from the
Contribution Golden Path. The full unit suite,
Vitest, the 60% coverage gate, and the production build all run in CI on this PR (#8329):
npm run lintTests Added Or Updated
Coverage Notes
src/,open-sse/,electron/, orbin/, explain which tests cover the change.Reviewer Notes