feat(providers): add Agnes AI (China) as agnes-cn on api.agnes-ai.cn

.env.example

@@ -737,6 +737,12 @@ NEXT_PUBLIC_CLOUD_URL=
 ENABLE_SOCKS5_PROXY=true
 NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 
+# Opt-in feature flag (default off; a dashboard DB override wins over this value): proxy pools
+# and per-account rotation stop re-serving a member that just failed (TCP probe refused, or a
+# 429 received through it) for a period that doubles on each repeat, up to a cap. No proxy
+# status is written. "true" (or 1, yes) enables it; unset keeps plain selection.
+# PROXY_SKIP_RECENTLY_FAILED=false
+
 # Standard proxy variables (lowercase variants also supported).
 # HTTP_PROXY=http://127.0.0.1:7890
 # HTTPS_PROXY=http://127.0.0.1:7890
@@ -1140,6 +1146,22 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: src/lib/db/core.ts::getWalTruncateIntervalMs().
 #OMNIROUTE_WAL_TRUNCATE_INTERVAL_MS=21600000
 
+# Frequent wal_checkpoint(PASSIVE) cadence (ms).  Set to 0 to disable.  Default: 300000 (5m).
+# Used by: src/lib/db/walMaintenance.ts.
+#OMNIROUTE_WAL_PASSIVE_INTERVAL_MS=300000
+
+# WAL size (MB) above which a PASSIVE tick escalates to wal_checkpoint(TRUNCATE).  Default: 256.
+# Used by: src/lib/db/walMaintenance.ts.
+#OMNIROUTE_WAL_GUARD_MAX_MB=256
+
+# Minimum rows a cleanup must delete before the post-cleanup VACUUM runs.  Default: 1000.
+# 0 always vacuums when rows were freed.  Used by: src/lib/db/cleanup.ts.
+#OMNIROUTE_VACUUM_MIN_DELETED_ROWS=1000
+
+# Explicit path to sql-wasm.wasm for the sql.js fallback adapter.  Default: auto-detect.
+# Used by: src/lib/db/adapters/sqljsAdapter.ts.
+#OMNIROUTE_SQLJS_WASM_PATH=
+
 # Skip the Redis-backed auth cache used by API key lookups (forces DB reads).
 # Used by: src/lib/db/apiKeys.ts.  Set to 1 to disable.  Default: enabled.
 #OMNIROUTE_DISABLE_REDIS_AUTH_CACHE=0
@@ -1670,6 +1692,8 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # ── TLS client (wreq-js fingerprint proxy) ──
 # TLS_CLIENT_TIMEOUT_MS=600000       # Inherits from FETCH_TIMEOUT_MS by default
 # TLS_FIRST_BYTE_WATCHDOG_MS=10000   # #12656: bounds time-to-first-byte on the wreq body (0 disables)
+# OPENCODE_RESPONSES_STALL_ROTATION=false  # #13484 feature flag (Settings → Feature Flags wins): rotate once when a streamed Responses reply stalls before its first byte
+# RESPONSES_FIRST_BYTE_TIMEOUT_MS=15000  # #13484: OpenCode Responses first-byte window, only used when the OPENCODE_RESPONSES_STALL_ROTATION flag is on (0 disables)
 
 # ── API Bridge (/v1 proxy server) ──
 # API_BRIDGE_PROXY_TIMEOUT_MS=600000             # Proxy hop timeout (default: 10min)
@@ -1800,6 +1824,13 @@ APP_LOG_TO_FILE=true
 # Override only to hand-tune for a known workload.
 # HEAP_PRESSURE_THRESHOLD_MB=
 
+# Exit the process after critical resource pressure persists, so a supervisor
+# (systemd Restart=always, Docker restart policy) brings back a clean process.
+# Accepts 1/true/yes/on.  Default: false.  Used by: open-sse/utils/resourcePressure.ts.
+# OMNIROUTE_PRESSURE_SELF_RESTART=false
+# How long (ms) critical pressure must persist before that exit fires.  Default: 120000 (2m).
+# OMNIROUTE_PRESSURE_SELF_RESTART_AFTER_MS=120000
+
 # ── CLI helpers (bin/cli/) ──
 # Override UI language for CLI output. Accepts BCP-47 locale (e.g. en, pt-BR).
 # Falls back to LC_ALL / LC_MESSAGES / LANG / en if unset.
@@ -1817,6 +1848,10 @@ APP_LOG_TO_FILE=true
 # Per-attempt HTTP timeout for CLI → server calls (milliseconds). Default: 30000.
 # OMNIROUTE_HTTP_TIMEOUT_MS=30000
 
+# How long `omniroute serve` waits for the health endpoint before printing the
+# readiness-timeout warning (milliseconds). Also --ready-timeout. Default: 60000.
+# OMNIROUTE_READY_TIMEOUT_MS=60000
+
 # Set to 1 to print retry/backoff details to stderr during CLI commands.
 # OMNIROUTE_VERBOSE=0
 
@@ -1962,6 +1997,12 @@ APP_LOG_TO_FILE=true
 # Default: 8000 (8 seconds). On timeout, a last-good 200 is served when available.
 # CATALOG_BUILD_TIMEOUT_MS=8000
 
+# Age after which a connection's synced model list stops being authoritative for routing (#12849).
+# A stale (or never-timestamped) synced catalog fails open to the provider registry.
+# Used by: src/lib/db/models/activeSyncedCatalog.ts
+# Default: 2592000000 (30 days)
+# OMNIROUTE_SYNCED_CATALOG_STALE_AFTER_MS=2592000000
+
 # ── NanoBanana (Image Generation) ──
 # Polling config for async image generation jobs.
 # Used by: open-sse/handlers/imageGeneration.ts
@@ -2198,15 +2239,20 @@ APP_LOG_TO_FILE=true
 # proxy — only the operator sets active/inactive (a flaky probe must not strand an
 # assigned proxy; #6246). Set "true" to restore the legacy test-and-set behaviour.
 # PROXY_HEALTH_AUTO_DEACTIVATE=false
+# Opt-in feature flag (default off; a dashboard DB override wins over this value): show,
+# under a proxy pool in the dashboard, how many observed egress IPs served its members over
+# the last 24 h and how many connections used them (read-only, computed from the proxy log,
+# never used for routing). "true" (or 1, yes) enables it.
+# PROXY_POOL_EGRESS_OBSERVATION=false
 
 # Allow OAuth and provider validation flows to bypass a pinned proxy and connect
 # directly when proxy reachability pre-checks fail. Default: false.
 # Also configurable from Dashboard > Settings > Feature Flags.
 # OMNIROUTE_CONTROL_PLANE_PROXY_DIRECT_FALLBACK=false
 
-# Rate limit maximum wait time before failing a request (ms).  Default: 15000 (15s)
+# Rate limit maximum wait time before failing a request (ms).  Default: 30000 (30s)
 # Used by: open-sse/services/rateLimitManager.ts
-# RATE_LIMIT_MAX_WAIT_MS=15000
+# RATE_LIMIT_MAX_WAIT_MS=30000
 
 # Limiter-managed execution backstop (Bottleneck `expiration`): bounds a job's
 # post-dispatch execution, never queue wait. Must stay ABOVE upstream
@@ -2997,6 +3043,13 @@ QUOTA_STORE_DRIVER=sqlite
 # CHATGPT_WEB_CODEX_CHROME_PATH=/usr/bin/chromium
 # CHROME_PATH=/usr/bin/chromium
 # CHATGPT_WEB_CODEX_CDP_URL=http://chatgpt-web-codex-browser:9223
+# CDP_PROXY_TOKEN required by docker/chatgpt-web-codex-browser/cdp-proxy.mjs (#13679):
+# when set, every request to the CDP proxy sidecar must present it as an
+# `X-Omni-Cdp-Token` header. Left unset, the proxy keeps forwarding requests
+# unauthenticated (network isolation via docker-compose.yml's dedicated
+# `chatgpt-web-codex-net` is the default mitigation). Generate with:
+# `openssl rand -hex 32`
+# CDP_PROXY_TOKEN=
 # CHATGPT_WEB_CODEX_TUNNEL_ID=tunnel_0123456789abcdef0123456789abcdef
 # CHATGPT_WEB_CODEX_RUNTIME_KEY=
 # CHATGPT_WEB_CODEX_CONNECTOR_NAME=OmniRoute Codex v2

.github/workflows/ci.yml

@@ -511,9 +511,11 @@ jobs:
       - run: node scripts/i18n/check-ui-keys-coverage.mjs --threshold=65
       # Real-translation ratchet: a leaf copied verbatim from en.json passes key
       # parity above but is still English to the user (es shipped 55% English).
-      # Advisory in PR-0; flipped to blocking once the backlog is retranslated (PR-4).
-      - name: i18n real-translation ratio (advisory)
-        run: node scripts/i18n/check-translation-ratio.mjs --warn
+      # Blocking since PR-4 retranslated the verbatim-English backlog: the share of
+      # untranslated leaves per locale may only fall (ratchet baseline in
+      # config/quality/i18n-translation-baseline.json; `npm run i18n:check-ratio:update`).
+      - name: i18n real-translation ratio
+        run: node scripts/i18n/check-translation-ratio.mjs
       # #8463: a rewritten English value used to leave its 39 translations behind
       # silently (googleOAuthWarning shipped wrong copy in 39 locales for months).
       # Key parity above cannot see it — a stale translation counts as covered.
@@ -531,6 +533,15 @@ jobs:
         env:
           BASE_REF: ${{ github.base_ref && format('origin/{0}', github.base_ref) || '' }}
         run: node scripts/i18n/check-new-key-coverage.mjs
+      # Absolute complement of the two gates above: every locale must carry exactly the key
+      # set of en.json, whatever the age of the key. A locale batch is generated from the
+      # en.json of the day the branch is cut and translates for days while the base keeps
+      # adding keys — the batch PR adds no key itself, so the new-key gate stays silent and
+      # 43 absent keys out of ~13,000 still read 99.7 % coverage. Incident 2026-09-15:
+      # batch 1 (#13044) landed 43 keys short in nine locales, batch 2 (#13660) 10 keys short
+      # in eight. Fix is `sync-ui-keys --locale=<codes> --translate-markers`.
+      - name: i18n key completeness (every locale carries every en.json key)
+        run: node scripts/i18n/check-key-completeness.mjs
 
   # #8038: cheap glossary/protected-terms consistency gate —
   # complements i18n-ui-coverage (key parity) and the ICU `i18n` job below

.github/workflows/radar-export.yml

@@ -10,7 +10,11 @@ name: Radar Export
 on:
   workflow_dispatch: # o operador pode publicar sob demanda (de qualquer ref)
   push:
-    branches: [main] # produção: só o catálogo do main clobra o asset estável
+    # `main` e a release ativa (default branch) publicam no mesmo asset estável: o
+    # radar-server só consome o asset, então um merge de catálogo na release que ficasse
+    # à espera do cron semanal deixava o feed até 7 dias atrás do README (2026-09-14: a
+    # linha da Together removida em d6e62ae só saiu do feed com dispatch manual).
+    branches: [main, "release/**"]
     paths:
       - open-sse/config/freeModelCatalog.data.ts
       - open-sse/config/freeModelCatalog.ts
@@ -19,7 +23,9 @@ on:
       - scripts/release/radar-export.mjs
       - .github/workflows/radar-export.yml
   schedule:
-    - cron: "17 6 * * 1" # semanal (segunda 06:17 UTC): mantém geradoEm/proveniência frescos
+    # Diário 03:17 UTC — antes do `radar-feed.timer` do servidor (04:23 UTC), para o ciclo
+    # do dia já enxergar o export do dia; também mantém geradoEm/proveniência frescos.
+    - cron: "17 3 * * *"
 
 permissions:
   contents: read

.github/workflows/release-acceptance.yml

@@ -0,0 +1,42 @@
+name: Release acceptance
+
+on:
+  push:
+    branches: ["release/v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-acceptance-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  acceptance:
+    name: Release acceptance
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
+          cache: npm
+      - run: npm ci
+      - name: Emit shadow acceptance report
+        run: |
+          node scripts/quality/validate-release-acceptance.mjs \
+            --plan tests/fixtures/release-acceptance/plan-lint.json \
+            --manifests tests/fixtures/release-acceptance/shadow-manifests \
+            --out release-acceptance-report.json
+        continue-on-error: true
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: release-acceptance-report
+          path: release-acceptance-report.json
+          if-no-files-found: ignore
+          retention-days: 30

.gitleaks.toml

@@ -97,4 +97,11 @@
       # credential; the generic-api-key rule flags the long hyphenated string.
       '''omniroute-cheaperinference-sponsor-banner-dismissed-v\d+''',
       '''SunbreakWebUI1''',
+      # Uzbek dashboard catalog (#13727, src/i18n/messages/uz.json `outputTokenDesc`):
+      # "Yakunlash/javob tokenlari" = "completion/response tokens". The rule reads the
+      # `...TokenDesc` key as a token assignment and the translated words as its value.
+      '''Yakunlash/javob''',
+      # Feature-flag id from #13439 (src/shared/constants/featureFlagDefinitions.ts):
+      # `key: "PROTECTED_PRIORITY_INFRA_502_ENABLED"` is a flag name, not a credential.
+      '''PROTECTED_PRIORITY_INFRA_502_ENABLED''',
     ]