Skip to content

Feat/features batch v3.8.0 - #2431

Merged
diegosouzapw merged 15 commits into
release/v3.8.0from
feat/features-batch-v3.8.0
May 20, 2026
Merged

diegosouzapw merged 15 commits into
release/v3.8.0from
feat/features-batch-v3.8.0

Conversation

@diegosouzapw

Copy link
Copy Markdown
Owner

Summary

  • Describe the user-facing or operational change.

Related Issues

  • Closes #
  • Related to #

Validation

  • npm run lint
  • npm run test:unit
  • npm run test:coverage
  • Coverage is still >= 60% for statements, lines, functions, and branches
  • SonarQube PR analysis is green or any remaining issues are explicitly documented below

Tests Added Or Updated

  • List every changed or added automated test file.
  • If no production code changed, state that here.

Coverage Notes

  • If this PR changes src/, open-sse/, electron/, or bin/, explain which tests cover the change.
  • If coverage moved down in any touched file, explain why and what follow-up task will recover it.

Reviewer Notes

  • Call out any risky areas, migrations, feature flags, or manual validation that reviewers should know about.

Registers t3-web / t3chat-alias executor, 24-model registry, WEB_COOKIE_PROVIDERS
entry, i18n hints, docs row, and 19-case test suite (all passing). Endpoint URL
and SSE chunk schema require a post-devtools-capture follow-up — marked with
TODO(post-devtools-capture) comments throughout.
…UI panel (#2306)

- Refactor dockerDetect.ts to accept optional deps for testability
- Add Docker guard (HTTP 422 + zedDockerEnvironment flag) to import route
- Add POST /api/providers/zed/manual-import endpoint with Zod validation
- Add collapsible Manual Token Import panel to Zed provider page (auto-expands on Docker error)
- Add 4 unit tests for isRunningInDocker via dependency injection
- Add docs/providers/ZED-DOCKER.md Docker setup guide

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces several new features and improvements, including Zed IDE Docker support, a new 'llama.cpp' local provider, and a robust API key rotation and status command set for the CLI. It also adds a 't3.chat' web provider and implements per-connection OIDC client isolation for Kiro accounts to prevent session conflicts. I have reviewed the code and identified several high-severity issues where functions like runProviderTest, statusColor, and getModelContextLimitForModelString are referenced but not imported, which will cause runtime crashes. Additionally, there is a suggestion to refactor redundant database write logic in the new provider rotation command.

try {
const fresh = findProviderConnection(db3, connection.id);
if (fresh) {
const result = await runProviderTest(db3, fresh);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The function runProviderTest is used here but it is not imported or defined within this module. This will cause a runtime error when the command attempts to perform a post-rotation connectivity test.

Comment on lines +467 to +468
const expiryColor = statusColor(expiryStatus);
const testColor = statusColor(testStatus);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The function statusColor is used but not defined or imported in this file. This will cause the providers status command to crash when attempting to format the output table.

const estimatedInputTokens = estimateTokens(body?.messages ?? []);
if (estimatedInputTokens > 0) {
const filteredByContext = eligibleTargets.filter((target) => {
const limit = getModelContextLimitForModelString(target.modelStr);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The function getModelContextLimitForModelString is used but not imported. It should likely be imported from ./modelCapabilities.ts where other model metadata helpers reside.

Comment on lines +376 to +405
const serverUp = await isServerUp();
if (serverUp) {
try {
const res = await apiFetch(`/api/providers/${encodeURIComponent(connection.id)}`, {
method: "PATCH",
body: { apiKey: newKey, testStatus: "unknown", lastError: null, rateLimitedUntil: null, backoffLevel: 0 },
retry: false,
acceptNotOk: true,
});
if (!res.ok) {
console.error(t("common.error", { message: `HTTP ${res.status}` }));
return 1;
}
} catch {
// Fall through to direct DB write
const { db: db2 } = await openOmniRouteDb();
try {
updateProviderApiKey(db2, connection.id, encryptCredential(newKey));
} finally {
db2.close();
}
}
} else {
const { db: db2 } = await openOmniRouteDb();
try {
updateProviderApiKey(db2, connection.id, encryptCredential(newKey));
} finally {
db2.close();
}
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The logic for updating the provider API key in the database is duplicated across the try-catch and else blocks. Additionally, the database is opened and closed multiple times (openOmniRouteDb). Consider refactoring the database write into a single block and keeping the connection open if multiple operations are needed to improve efficiency.

@kilo-code-bot

kilo-code-bot Bot commented May 20, 2026 •

Copy link
Copy Markdown

Code Review Summary (Incremental Review)

Status: 10 Issues Found (2 CRITICAL) | Recommendation: PR already merged — address urgently via follow-up fix PR

Overview

Severity Count
CRITICAL 2
WARNING 5
SUGGESTION 3
Issue Details (click to expand)

CRITICAL

File Line Issue
open-sse/executors/default.ts 260-264 BREAKING API change not propagated to all callers. getValidApiKey() in apiKeyRotator.ts return type changed from string | null to { key: string; keyId: string } | null. default.ts:260-264 still consumes this as a plain string: const effectiveKey = … ? getValidApiKey(…) || credentials.apiKey. The object is truthy so the || fallback never fires. headers['x-goog-api-key'] = effectiveKey serialises to "[object Object]", breaking ALL providers routed through DefaultExecutor with extra API keys configured (Gemini, Snowflake, etc.). Fix: destructure .key or revert return type.
tests/unit/api-key-rotator-health.test.ts 13, 110, 326, 329, 408, 445 Tests import getLastUsedKeyId which was deleted from apiKeyRotator.ts and removed from exports. These tests will fail to compile/run. All getValidApiKey() assertions in this file also expect string returns, now getting { key, keyId }. Needs full test rewrite to match the new API.

WARNING

File Line Issue
open-sse/services/apiKeyRotator.ts 59 FAILURE_THRESHOLD lowered from 3 to 2 without migration or deprecation notice. Keys marked "invalid" after only 2 consecutive failures — transient upstream 401 storms during deploys will disable keys faster, increasing rotation thrash.
src/app/api/gamification/federation/leaderboard/route.ts 44 limit parameter has no upper bound or minimum validation. A caller can set limit=10000000 or negative values. Consider clamping: Math.min(Math.max(1, Number(limitParam) || 100), 500).
src/app/api/providers/[id]/test/route.ts 687-689 Empty catch block silently swallows all errors from removeConnectionHealth(). At minimum log the error.
open-sse/handlers/chatCore.ts 1347-1357 Lost-update race condition in recordKeyHealthStatus. Two concurrent 401s for the same connection capture the same health snapshot and each writes { ...health, [keyId]: updated }. The second write overwrites the first's key update. The in-memory _keyHealth map stays correct, but persisted DB state diverges. Consider optimistic-lock read-modify-write.
src/app/api/gamification/federation/leaderboard/route.ts + score/route.ts + servers.ts multiple Hardcoded PBKDF2 salt "omniroute-federation-salt" exposed in source code across 3 files. If an attacker reads the codebase, they can precompute rainbow tables for API key hashes. Consider a configurable salt from env vars.

SUGGESTION

File Line Issue
open-sse/services/apiKeyRotator.ts 106-108 console.warn in production code. Should use pino or the project's log object for observability pipeline capture.
src/lib/gamification/antiCheat.ts 92-97 getAnomalies() calls computeZScore() sequentially with await in a for-loop. Could use Promise.all(rows.map(...)) for parallelization.
open-sse/handlers/chatCore.ts 3363, 3379 _executionCredentials is an ad-hoc property attached to response objects without typing. Any consumer gets any access. Consider a typed interface for the extended response shape.
Other Observations (not in diff)

Issues found in unchanged code or outside diff hunks:

File Line Issue
open-sse/executors/default.ts 260-264 See CRITICAL above — affected by getValidApiKey() return type change in this PR.
tests/unit/api-key-rotator-health.test.ts multiple See CRITICAL above — imports deleted getLastUsedKeyId function.
Files Reviewed (68 files)
  • open-sse/services/apiKeyRotator.ts — Breaking return type change, threshold change, new resolveKeyForRequest, cleanup helpers
  • open-sse/handlers/chatCore.ts — Refactored key health recording, _executionCredentials passthrough
  • open-sse/executors/base.ts — resolveKeyForRequest usage, fixToolPairs re-run for Claude
  • open-sse/executors/default.ts — NOT changed but broken by getValidApiKey() return type
  • src/app/api/gamification/federation/leaderboard/route.ts — Bearer token auth, PBKDF2 hashing
  • src/app/api/gamification/federation/score/route.ts — SHA256 → PBKDF2 upgrade
  • src/app/api/providers/[id]/route.ts — apiKeyHealth cleanup on PUT
  • src/app/api/providers/[id]/test/route.ts — Health reset on successful test
  • src/lib/gamification/antiCheat.ts — Z-score computation refactor
  • src/lib/gamification/events.ts — SELECT fix
  • src/lib/gamification/leaderboard.ts — Offset passthrough fix
  • src/lib/gamification/servers.ts — SHA256 → PBKDF2 upgrade
  • src/lib/gamification/index.ts — New barrel exports
  • src/lib/gamification/invites.ts — crypto.randomInt fix
  • src/lib/db/gamification.ts — Offset support, level computation fix
  • src/sse/handlers/chatHelpers.ts — allExpired terminal state handling
  • src/sse/services/auth.ts — Terminal connection detection, health sync from DB
  • src/shared/components/NotificationToast.tsx — UI fixes (e.stopPropagation, dark bg)
  • tests/unit/chat-helpers.test.ts — allExpired tests
  • tests/unit/gamification/* — Anti-cheat, DB, events, federation, leaderboard tests
  • tests/unit/image-generation-handler.test.ts — Antigravity image gen tests
  • tests/unit/notificationStore.test.ts — New notification store tests
  • src/app/docs/lib/docs-auto-generated.ts — Nav/search index updates
  • src/i18n/messages/*.json — i18n additions across 41 locales

Reviewed by qwen3.6-plus · 1,429,127 tokens

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a9cef6dbad

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +273 to +276
const missing = !rawCreds.cookies
? "cookies"
: !rawCreds.convexSessionId
? "convexSessionId"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Guard missing creds before reading rawCreds fields

When execute() is called without a credentials object (e.g., misconfigured provider connection), this branch dereferences rawCreds.cookies/rawCreds.convexSessionId before any null-safe check, which throws a TypeError instead of returning the intended 400 error payload. That turns a recoverable validation error into an unhandled executor failure path for t3-web requests.

Useful? React with 👍 / 👎.

Comment on lines +1997 to 2000
// #1731: Per-request in-memory set of providers whose quota is fully exhausted.
// When a target returns a quota-exhausted 429, remaining same-provider targets are skipped.
const exhaustedProviders = new Set<string>();
let globalAttempts = 0;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Clear exhaustedProviders at each set retry attempt

exhaustedProviders is scoped outside the for (setTry...) loop, so once a provider is marked exhausted in the first pass, later set retries skip that provider entirely instead of retrying it. With maxSetRetries > 0, this can make set retries no-ops and surface misleading terminal behavior (e.g., generic inactive-accounts response) even though the feature is supposed to retry the full target set.

Useful? React with 👍 / 👎.

…ation/i18n/test regressions

Resets 68 files to release/v3.8.0 state to prevent:
- Auth: allExpired detection, apiKeyHealth sync, terminal connection handling
- Security: federation leaderboard auth, pbkdf2 hashing, antiCheat zScore
- Executor: fixToolPairs after fixToolAdjacency (Claude tool adjacency)
- Provider: apiKeyHealth cleanup on key rotation
- UI: NotificationToast onClick stopPropagation
- i18n: ~50 deleted keys in en.json + all 41 locales
- Tests: 500+ lines of deleted tests restored

New features (t3.chat, combo exhaustion, Kiro multi-account, Zed Docker,
context window filter, CLI rotate, E2E failover) remain intact.
@diegosouzapw
diegosouzapw changed the base branch from main to release/v3.8.0 May 20, 2026 12:26
HouMinXi pushed a commit to HouMinXi/OmniRoute that referenced this pull request Aug 2, 2026
…batch-v3.8.0

Integrated into release/v3.8.0 — features batch with regression-safe resets

New features:
- feat(combo): provider-level exhaustion tracking (diegosouzapw#1731)
- feat(combo): context window filtering (diegosouzapw#1808)  
- fix(combo): cost blending in auto-combo scoring (diegosouzapw#1812)
- feat(providers): t3.chat web provider (diegosouzapw#1909)
- feat(cli): providers rotate command (diegosouzapw#1881)
- feat(kiro): multi-account OAuth isolation (diegosouzapw#2328)
- feat(errors): sanitized upstream error details (diegosouzapw#1718)
- feat(installer): Termux detection (diegosouzapw#1764)
- feat(zed): Docker integration + manual import (diegosouzapw#2306)
- test(e2e): system failover test suite

68 regressive files were reset to release/v3.8.0 state to prevent regressions.
HouMinXi pushed a commit to HouMinXi/OmniRoute that referenced this pull request Aug 2, 2026
Sync release/v3.8.0 into main — includes features batch (diegosouzapw#2431), AgentRouter docs (diegosouzapw#2429), Gemini 3.5 Flash (diegosouzapw#2423)
Poid-ZA pushed a commit to Poid-ZA/OmniRoute that referenced this pull request Aug 5, 2026
…batch-v3.8.0

Integrated into release/v3.8.0 — features batch with regression-safe resets

New features:
- feat(combo): provider-level exhaustion tracking (diegosouzapw#1731)
- feat(combo): context window filtering (diegosouzapw#1808)  
- fix(combo): cost blending in auto-combo scoring (diegosouzapw#1812)
- feat(providers): t3.chat web provider (diegosouzapw#1909)
- feat(cli): providers rotate command (diegosouzapw#1881)
- feat(kiro): multi-account OAuth isolation (diegosouzapw#2328)
- feat(errors): sanitized upstream error details (diegosouzapw#1718)
- feat(installer): Termux detection (diegosouzapw#1764)
- feat(zed): Docker integration + manual import (diegosouzapw#2306)
- test(e2e): system failover test suite

68 regressive files were reset to release/v3.8.0 state to prevent regressions.
Poid-ZA pushed a commit to Poid-ZA/OmniRoute that referenced this pull request Aug 5, 2026
Sync release/v3.8.0 into main — includes features batch (diegosouzapw#2431), AgentRouter docs (diegosouzapw#2429), Gemini 3.5 Flash (diegosouzapw#2423)
muhamadgalihsaputra pushed a commit to niyatna/NiyatnaRoute that referenced this pull request Sep 27, 2026
…batch-v3.8.0

Integrated into release/v3.8.0 — features batch with regression-safe resets

New features:
- feat(combo): provider-level exhaustion tracking (diegosouzapw#1731)
- feat(combo): context window filtering (diegosouzapw#1808)  
- fix(combo): cost blending in auto-combo scoring (diegosouzapw#1812)
- feat(providers): t3.chat web provider (diegosouzapw#1909)
- feat(cli): providers rotate command (diegosouzapw#1881)
- feat(kiro): multi-account OAuth isolation (diegosouzapw#2328)
- feat(errors): sanitized upstream error details (diegosouzapw#1718)
- feat(installer): Termux detection (diegosouzapw#1764)
- feat(zed): Docker integration + manual import (diegosouzapw#2306)
- test(e2e): system failover test suite

68 regressive files were reset to release/v3.8.0 state to prevent regressions.
muhamadgalihsaputra pushed a commit to niyatna/NiyatnaRoute that referenced this pull request Sep 27, 2026
Sync release/v3.8.0 into main — includes features batch (diegosouzapw#2431), AgentRouter docs (diegosouzapw#2429), Gemini 3.5 Flash (diegosouzapw#2423)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant