fix: sete correções simples de issues abertas (base 3.8.52)

[afonsoft]

Summary

⚠️ base-red inherited: #15306

Correções simples de issues abertas, rebaseado em release/v3.8.52 (977d006). Um commit por issue:

• enc:v1: estrangeiro salvo verbatim (fix(security): credentials that already carry the enc:v1: prefix are stored verbatim — foreign ciphertext fails later as a confusing "Missing API key" #15930) — encrypt() pula valores já prefixados, então um blob cifrado por outra tool/outra key persistia sem nunca decriptar. POST /api/providers e PATCH /api/providers/[id] agora devolvem 400 para apiKey com prefixo enc:v1: que este deploy não consegue decriptar; envelope ainda decriptável continua permitido.
• omniroute api enviava {id} literal (fix(cli): generated omniroute api commands never substitute {id} path params — every get/patch/delete/test-by-id command is broken #15928) — os comandos gerados não substituíam path params. O gerador já emitia --id + url.replaceAll(); bin/cli/api-commands/*.mjs foi regenerado (npm run build:cli-api).
• Links 404 de skills ([bug] skills/omni-auth and cli-providers link to skills/omniroute-*/SKILL.md that no longer exist (404) #15665) — omni-auth, cli-serve, cli-providers e cli-eval apontavam para skills/omniroute-*/SKILL.md (migrados para os conjuntos omni-*/cli-*). Links repontados para os skills atuais. ⚠️ os arquivos alterados estão dentro dos blocos skill:custom-* — sobrevivem à regeração, mas podem precisar de aprovação do operador por serem superfície de instrução de agente.
• Doc do caminho Qoder PAT (docs(providers): Qoder PAT path has no tool calling, no streaming and a 45s cap — undocumented, breaks agent combos (499) #13697) — PAT pt-* spawna qodercli local por request: sem tool calling, sem streaming, cap de 45s — inútil para clientes agentes. Nota no PROVIDERS-GUIDE apontando OAuth/API key.
• Cobertura de regressão/gate para issues já corrigidas na base: teste provando que token_ledger sobrevive ao reset de uso (fix(backend): preserve token balances when resetting usage data #16004) e o gate check-docs-counts agora valida TODO docs/i18n/*/README.md que carregue a contagem de migrations (extrator tolerante à tradução, radical migrat) — o drift de docs: 65 README mirrors still say 178 migrations, and the docs-counts gate does not cover them #14574 não volta.

Related Issues

• Closes fix(security): credentials that already carry the enc:v1: prefix are stored verbatim — foreign ciphertext fails later as a confusing "Missing API key" #15930, fix(cli): generated omniroute api commands never substitute {id} path params — every get/patch/delete/test-by-id command is broken #15928, [bug] skills/omni-auth and cli-providers link to skills/omniroute-*/SKILL.md that no longer exist (404) #15665, docs(providers): Qoder PAT path has no tool calling, no streaming and a 45s cap — undocumented, breaks agent combos (499) #13697
• Related to fix(backend): preserve token balances when resetting usage data #16004, docs: 65 README mirrors still say 178 migrations, and the docs-counts gate does not cover them #14574 (já corrigidas na base — este PR adiciona a cobertura), fix(ci): nightly Schemathesis job fuzzes a server that never starts #15988 (corrigida na base pelo step Prepare isolated runtime state), 🔴 Release branch not green: release/v3.8.52 #15306 (base-red herdado)

Validation

• Change type: DB / security / CLI / docs / CI
• Focused tests: tests/unit/usage-history-reset.test.ts (3/3, incl. novo caso token_ledger survives 'all'), tests/unit/providers-enc-v1-guard.test.ts (3/3, novo)
• npm run lint (eslint nos arquivos alterados — limpo)
• Reconciliado com release/v3.8.52 (977d006)
• check-docs-counts-sync.mjs: 0 STRICT drift; mirrors cobertos
• check-api-typecheck.mjs: 272 erros, todos dentro do baseline (rebaixado em 9 mortos)
• Production-code changes incluem testes novos/atualizados neste PR.

Tests Added Or Updated

• tests/unit/usage-history-reset.test.ts — novo caso: token_ledger sobrevive ao reset 'all'.
• tests/unit/providers-enc-v1-guard.test.ts — novo arquivo: guard enc:v1: no POST/PATCH + invariante do encrypt().

Coverage Notes

• src/app/api/providers*/route.ts: guard coberto por teste de fonte + invariante no providers-enc-v1-guard.test.ts.
• tests/ e scripts/check/: nova cobertura de regressão.
• Resto é docs/código gerado — sem mudança de coverage.

Reviewer Notes

• bin/cli/api-commands/*.mjs é 100% gerado — revisar o diff do gerador, não os arquivos.
• No rebase, três commits viraram redundantes porque a base já continha a correção (fix(backend): preserve token balances when resetting usage data #16004 em RESET_TARGETS, docs: 65 README mirrors still say 178 migrations, and the docs-counts gate does not cover them #14574 nos mirrors, fix(ci): nightly Schemathesis job fuzzes a server that never starts #15988 no workflow); ficaram só a cobertura de teste e a extensão do gate que faltavam.

[afonsoft]

Corrigidas: #16004 (token_ledger no reset), #15930 (enc:v1: estrangeiro), #15928 ({id} literal no CLI), #15665 (links 404 de skills), #14574 (mirrors i18n + gate), #13697 (doc Qoder PAT), #15988 (DATA_DIR por run no nightly).

[afonsoft]

@diegosouzapw PR rebaseado em release/v3.8.52 (977d006) e mergeable de novo — poderia dar uma review?

Notas rápidas do rebase: a base já trouxe as correções de #16004 (token_ledger fora de RESET_TARGETS), #14574 (mirrors 202) e #15988 (step Prepare isolated runtime state no nightly), então esses três commits viraram só cobertura de regressão/gate. O escopo vivo é: guard enc:v1: em providers (#15930), regen dos api-commands com {id} substituído (#15928), repoint dos links skills/omniroute-* (#15665) e a nota do Qoder PAT (#13697).

Ficamos à disposição se precisar de ajuste em qualquer commit.

[diegosouzapw]

Thanks @afonsoft for putting this together. I'm closing it because nearly all of it has already landed on release/v3.8.52 through other PRs. A 137-file PR bundling seven unrelated changes can't be merged safely, and merging it as is would only add duplicate code. Item by item:

1. fix(backend): preserve token balances when resetting usage data #16004, token_ledger survives a usage reset: already covered by tests/unit/usage-history-reset-token-ledger.test.ts (fix(db): keep token_ledger when resetting usage data #16005). The issue is closed.
2. fix(security): credentials that already carry the enc:v1: prefix are stored verbatim — foreign ciphertext fails later as a confusing "Missing API key" #15930, enc:v1: guard on /api/providers: fix(security): reject encrypted-envelope credentials at provider create/update validation #15932 already rejects enc:v1: in the Zod schema for both create and update, so this route guard would be dead code. It is also looser than the tip: it accepts envelopes the deployment can decrypt, while the schema rejects all of them.
3. fix(cli): generated omniroute api commands never substitute {id} path params — every get/patch/delete/test-by-id command is broken #15928, CLI {id} path params: the generator fix is fix(cli): resolve required URL path parameters in generated commands #15955, already merged. The regenerated bin/cli/api-commands/* here matches the tip generator byte for byte, and prepublishOnly regenerates these files at publish time anyway.
4. [bug] skills/omni-auth and cli-providers link to skills/omniroute-*/SKILL.md that no longer exist (404) #15665, skill links: this is the part we're keeping. fix(skills): repoint deleted omniroute-* skill links (Fixes #15665) #15676 just landed the capability-table half. The CLI-table remaps from this PR go in a follow-up PR that credits you with Co-authored-by, with one fix: "Cloud agents (Codex / Devin / Jules)" pointed at cli-backup-sync, which is the backup skill.
5. docs: 65 README mirrors still say 178 migrations, and the docs-counts gate does not cover them #14574, README migration-count gate: fix(docs): validate migration counts across localized READMEs #15982 already wired buildReadmeMigrationChecks(). A second validator would report the same drift twice.
6. docs(providers): Qoder PAT path has no tool calling, no streaming and a 45s cap — undocumented, breaks agent combos (499) #13697, Qoder PAT docs: fix(qoder): keep PAT-only transport out of agent tool requests #15919 added a full "Qoder: choose the credential transport" section. Since then, PAT accounts are excluded or fail explicitly when a request carries tools, so the "answered in plain text" note here would now be wrong.
7. api-typecheck baseline (−9 entries): baseline edits only go in through the ratchet update on the current tip, so we can't take a hand-edited copy.

One more note: every commit here is authored by the Devin AI bot account, and this repo doesn't accept AI/bot authorship metadata in commits (Hard Rule #16 in AGENTS.md). For future PRs, please commit under your own identity. Thanks again, and the link fix will carry your credit.