Skip to content

[codex] add bifrost auto fallback cooldown - #5519

Merged
diegosouzapw merged 84 commits into
diegosouzapw:release/v3.8.42from
KooshaPari:codex/bifrost-failure-cooldown
Jun 30, 2026
Merged

[codex] add bifrost auto fallback cooldown#5519
diegosouzapw merged 84 commits into
diegosouzapw:release/v3.8.42from
KooshaPari:codex/bifrost-failure-cooldown

Conversation

@KooshaPari

@KooshaPari KooshaPari commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

  • add an in-process Bifrost failure cooldown for OMNIROUTE_RELAY_BACKEND=auto
  • skip Bifrost briefly after sidecar fetch/timeout failures so high-throughput traffic does not repeatedly stall on a down sidecar
  • expose OMNIROUTE_BIFROST_FAILURE_COOLDOWN_MS with a 5000 ms default and 0 to disable

Behavior

  • strict OMNIROUTE_RELAY_BACKEND=bifrost still attempts Bifrost and returns 502 on failure
  • auto mode falls back to the TypeScript relay with X-Routing-Fallback: bifrost-error after a failure
  • auto mode skips Bifrost during cooldown with X-Routing-Fallback: bifrost-cooldown; remaining=<ms>
  • a successful Bifrost response clears the cooldown for that sidecar URL

Validation

  • node --import tsx/esm --test tests/unit/api/v1/bifrost-cooldown.test.ts tests/unit/api/v1/relay-routing-backend.test.ts tests/unit/api/v1/bifrost-sidecar.test.ts
  • npx eslint src/app/api/v1/relay/chat/completions/route.ts src/app/api/v1/relay/chat/completions/routingBackend.ts src/app/api/v1/relay/chat/completions/bifrostCooldown.ts tests/unit/api/v1/bifrost-cooldown.test.ts tests/unit/api/v1/relay-routing-backend.test.ts

Refs #5316

diegosouzapw and others added 30 commits June 29, 2026 18:25
@diegosouzapw
chore(release): open v3.8.42 cycle
41619da 
Bump version to 3.8.42, add CHANGELOG placeholder, sync openapi/electron/open-sse + 42 i18n CHANGELOG mirrors.
@JxnLexn
chore: remove unused qdrant schema aliases (diegosouzapw#5404)
27a33be 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused memory schema aliases (diegosouzapw#5403)
4149dcf 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused quota schema types (diegosouzapw#5402)
898e8d0 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused playground row type (diegosouzapw#5401)
537b565 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused codegraph exports (diegosouzapw#5400)
7bd0bc8 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused notion client type (diegosouzapw#5399)
be97882 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused settings types (diegosouzapw#5398)
a4c0a95 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused combo types (diegosouzapw#5396)
34510fb 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused provider types (diegosouzapw#5393)
44757af 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused skillssh skill type (diegosouzapw#5392)
d650117 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused status hex key type (diegosouzapw#5391)
53ebc39 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused batch provider type (diegosouzapw#5390)
589c0a5 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused skills schema types (diegosouzapw#5389)
2c8f9c5 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused codex auth input type (diegosouzapw#5388)
b52bb6d 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused memory schema types (diegosouzapw#5387)
272fccc 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused playground row type (diegosouzapw#5386)
30cee54 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused qdrant schema types (diegosouzapw#5385)
5f7aecd 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused kiro social schema (diegosouzapw#5384)
52f2575 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused memory schema types (diegosouzapw#5383)
1970e7b 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused audit action type (diegosouzapw#5382)
5c66eb9 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused agent skills schema types (diegosouzapw#5381)
8e8d08e 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused shared logger default export (diegosouzapw#5380)
f2d7aa9 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused sse logger helpers (diegosouzapw#5378)
eaff010 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused sse model legacy helpers (diegosouzapw#5377)
f91eb28 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused v1 search response schema (diegosouzapw#5376)
4b82560 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused cloud agent result schemas (diegosouzapw#5375)
3578711 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused a2a routing logger readers (diegosouzapw#5374)
655fcca 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused webhook delivery detail export (diegosouzapw#5372)
3c28b93 
Integrated into release/v3.8.42
@JxnLexn
chore: remove unused api key type (diegosouzapw#5395)
79c39e7 
Integrated into release/v3.8.42
JxnLexn and others added 4 commits June 29, 2026 22:17
@JxnLexn @diegosouzapw
chore(dead-code): ratchet dead code baseline (diegosouzapw#5468)
36e771c 
Ratchet dead-code baseline to the true measured value (310 -> 225) after the v3.8.42 dead-code + duplication wave. Measured by check-dead-code.mjs on the tip.

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
@diegosouzapw
fix(dashboard): provider-add UX — i18n labels, surface import warning…
8388992 
…, default key name (diegosouzapw#5511)

* fix(dashboard): provider-add UX — real i18n labels, surface import warning, default key name (diegosouzapw#5421 diegosouzapw#5428 diegosouzapw#5429 diegosouzapw#5431 diegosouzapw#5435)

Three rough edges in the Add-API-Key / model-import flow, all from the
provider-catalog audit:

1. Validation Model + Account ID form fields shipped untranslated i18n
   stub copy ('Validation Model Id Label', etc.) that rendered verbatim.
   Replaced with real copy in en.json.
2. Model import silently fell back to the cached/local catalog — the route
   returns a 'warning' field the import hook never read. New pure helper
   extractImportWarning surfaces it as a log line.
3. Required connection-name field defaulted to '' (let browser autofill
   inject garbage like 'wiw'); now defaults to 'main'.

Regression guard: tests/unit/provider-add-ux-i18n-import-warning.test.ts.

* fix(dashboard): compress AddApiKeyModal comment to keep file under frozen size cap
@diegosouzapw
fix(providers): align Muse Spark (Meta AI) cookie copy to ecto_1_sess (…
8f5eda9 
…diegosouzapw#5449) (diegosouzapw#5513)

* fix(providers): align Muse Spark (Meta AI) cookie copy to ecto_1_sess (diegosouzapw#5449)

The default Meta AI session cookie migrated from the retired abra_sess to
ecto_1_sess (META_AI_DEFAULT_COOKIE), but the provider form hint and one
401 auth-failure message still named abra_sess, telling users to paste a
cookie that no longer exists. Both strings now name ecto_1_sess.

Regression guard: tests/unit/muse-spark-cookie-copy-5449.test.ts.

* chore: reconcile CHANGELOG with release (keep diegosouzapw#5449 + diegosouzapw#5511 bullets)
@diegosouzapw
fix(providers): correct FriendliAI (serverless) + Novita (/openai/v1)…
f4b1aee 
… endpoints (diegosouzapw#5430 diegosouzapw#5455) (diegosouzapw#5515)

* fix(providers): correct FriendliAI (serverless) and Novita (/openai/v1) endpoints (diegosouzapw#5430 diegosouzapw#5455)

Both rejected valid keys, verified live with real provider keys:
- FriendliAI baseUrl was /dedicated/v1/... which 403s a serverless flp_* token;
  switched to /serverless/v1/... + serverless modelsUrl.
- Novita baseUrl was the legacy /v3/... with a typo'd model id ai-ai/...
  (both 404); switched to OpenAI-compat /openai/v1/... + meta-llama/llama-3.1-8b-instruct.

Regression guard: tests/unit/provider-endpoints-friendliai-novita.test.ts.

* chore: reconcile CHANGELOG with release (keep diegosouzapw#5430/diegosouzapw#5455 + prior bullets)
@KooshaPari
KooshaPari requested a review from diegosouzapw as a code owner June 30, 2026 01:55
@gemini-code-assist

gemini-code-assist Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

diegosouzapw and others added 3 commits June 29, 2026 23:10
@diegosouzapw
fix(providers): gate import for tool-only providers + sanitize Coze v…
17b3669 
…alidation error (diegosouzapw#5420 diegosouzapw#5426) (diegosouzapw#5522)

diegosouzapw#5420: the 'Import Models' button now hides for tool-only providers
(web search / web fetch) via a capability check over resolved serviceKinds,
not just the -search suffix — firecrawl/jina-reader (webFetch) no longer
show an Import button that 400s. No LLM/media provider is affected.

diegosouzapw#5426: Coze key validation no longer leaks the raw upstream envelope
({code,msg,logId,from}) into the UI; the Coze error becomes a friendly
message, scoped to provider === 'coze' so no other provider is affected.

Regression guards: tests/unit/model-listing-capability-5420.test.ts,
tests/unit/coze-validation-error-5426.test.ts.
@backryun
fix(providers): correct LongCat free tier — GA LongCat-2.0, one-time …
2c07f23 
…10M (KYC) (diegosouzapw#5508)

LongCat's preview ended and the Flash-* line was retired (2026-05-29);
the API now exposes only the GA LongCat-2.0 (1M context, 128K output).
The free tier is a ONE-TIME 10M-token grant unlocked after account
signup + KYC verification — NOT a recurring daily/monthly allowance.
The catalog still described the retired preview/Flash models and a
recurring 150M / 5M-per-day budget; this corrects every reference.

Config / code:
- registry/longcat: model LongCat-2.0-Preview -> LongCat-2.0, name +
  comment reflect one-time 10M (KYC) and pay-as-you-go beyond it.
- freeModelCatalog: longcat-2.0-preview (150M, recurring-daily) ->
  LongCat-2.0 (10M, freeType one-time-initial via creditTokens).
- freeTierCatalog: drop longcat from the recurring-monthly budget map
  (one-time credits are excluded by that catalog's own rule).
- regional.ts freeNote: one-time 10M after signup + KYC, not recurring.
- providerCostData: longcat-flash-lite -> longcat-2.0 (pay-as-you-go
  0.75/2.95 per 1M, 10M free quota).
- validation probe model longcat -> LongCat-2.0.

Tests:
- free-tier-catalog: longcat now absent from FREE_TIER_BUDGETS;
  providerCount 22->21 (clean 21->20); documented total ~1.39B.
- tierResolver: sample model flash-lite -> LongCat-2.0.

Docs:
- README, PROVIDERS-GUIDE, FREE-TIERS-GUIDE, FREE_TIERS: 50M/day
  Flash-Lite -> one-time 10M LongCat-2.0 (KYC); 'No auth' -> API key + KYC.
- Regenerated PROVIDER_REFERENCE.md (picks up the new freeNote).

typecheck:core clean; changed-file lint 0 errors; docs-sync PASS.
@diegosouzapw
fix(providers): Bytez OpenAI-compat base URL + auth-only key validati…
b09875d 
…on (diegosouzapw#5422) (diegosouzapw#5528)

Bytez IS OpenAI-compatible at .../models/v2/openai/v1, but the registry
stored the bare .../models/v2 base, so validation's chat-probe hit
.../models/v2/chat/completions -> 404 -> 'endpoint not supported'.

Part A: registry baseUrl -> full OpenAI-compat chat path.
Part B: a Bytez account only serves catalog-provisioned models, so chat-probe
validation 404s even for valid keys. validateBytezProvider instead probes the
auth-only GET .../models/v2/list/tasks (200=valid, 401/403=invalid).

Verified live with a real key: list/tasks -> 200 (valid) / 401 (invalid).
Regression guard: tests/unit/bytez-validation-5422.test.ts.
@KooshaPari

KooshaPari commented Jun 30, 2026

Copy link
Copy Markdown
Contributor Author

Added follow-up commit �ec1e0ab4 on codex/bifrost-failure-cooldown to expose richer Bifrost fallback metadata headers (X-Routing-Fallback-*). Also tracked issue: #5539

backryun and others added 12 commits June 30, 2026 02:01
@backryun
fix(providers): remove dead Phind provider + dedupe HuggingChat catal…
2ce25e7 
…og listing (diegosouzapw#5530)

Integrated into release/v3.8.42 (round 3). Dead Phind removal + HuggingChat dedupe, verified complete.
@rdself
fix: protect dynamic dashboard tests with CSRF (diegosouzapw#5405)
285b13e 
Integrated into release/v3.8.42 (round 3). Reworked CSRF (HMAC-signed synchronized token).
@KooshaPari
docs: clarify bifrost relay backend envs (diegosouzapw#5520)
7a06050 
Integrated into release/v3.8.42 (round 3). Doc-only: bifrost relay envs.
@diegosouzapw
test(quota): guard Claude-Code identity version lockstep (Phase 2) (d…
2c9a80b 
…iegosouzapw#5514)

Integrated into release/v3.8.42 (round 3). Claude-Code identity version lockstep guard.
@diegosouzapw
feat(compression): T02 — honest default-on pipeline inflation guard (…
47de0a1 
…H1) (diegosouzapw#5527)

Integrated into release/v3.8.42 (round 3). T02 pipeline inflation guard
@diegosouzapw
feat(compression): T05/C2 — caveman dedup + ultra packs for de, fr, ja (
1c882ed 
diegosouzapw#5529)

Integrated into release/v3.8.42 (round 3). T05/C2 caveman packs de/fr/ja
@diegosouzapw
feat(compression): T05/C6 — Chinese (zh / wenyan) caveman pack + dete…
8946860 
…ction (diegosouzapw#5532)

Integrated into release/v3.8.42 (round 3). T05/C6 zh/wenyan pack + detection
@diegosouzapw
feat(compression): T07/R9 — gradle + dotnet RTK catalog filters (dieg…
a32cfb1 
…osouzapw#5537)

Integrated into release/v3.8.42 (round 3). T07/R9 RTK gradle+dotnet filters
@diegosouzapw
refactor(dashboard): T11 — drop duplicate caveman on/off toggle from …
eea8182 
…the compression settings tab (diegosouzapw#5524)

Integrated into release/v3.8.42 (round 3). T11 consolidate duplicate caveman controls; i18n'd the panel hint string (source key).
@KooshaPari
test relay routing fallback headers (diegosouzapw#5526)
76a3e1a 
Integrated into release/v3.8.42 (round 3). Relay fallback header extraction + tests (drift-shed: dependabot diegosouzapw#5415 commit dropped).
@herjarsa
fix(opencode-plugin): bump to 0.2.0 + auto-publish on release (diegos…
eb392aa 
…ouzapw#5363)

- Bump @omniroute/opencode-plugin from 0.1.0 to 0.2.0 so CI publishes
  the accumulated fixes (auto combos, schema fields, debug logging) that
  were merged after the initial 0.1.0 publish on May 24.
- Add auto-bump step in npm-publish.yml: detects if the plugin dir
  changed since the last release tag and auto-increments patch version,
  so the plugin never falls behind again on future releases.

Co-authored-by: herjarsa <herjarsa@users.noreply.github.com>
@KooshaPari @diegosouzapw
add bifrost auto fallback cooldown
846b6be 
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
@diegosouzapw
diegosouzapw changed the base branch from main to release/v3.8.42 June 30, 2026 05:19
@diegosouzapw
diegosouzapw force-pushed the codex/bifrost-failure-cooldown branch from bec1e0a to 846b6be Compare June 30, 2026 05:19
@diegosouzapw
diegosouzapw merged commit f462983 into diegosouzapw:release/v3.8.42 Jun 30, 2026
4 of 7 checks passed
@diegosouzapw diegosouzapw mentioned this pull request Jun 30, 2026
Merged
diegosouzapw added a commit that referenced this pull request Jul 1, 2026
@Ardem2025 @diegosouzapw
@JxnLexn @dependabot @rdself @KooshaPari KooshaPari @backryun @herjarsa @Thinkscape @pizzav-xyz OpenClaw Auto
fix(proxyfetch): skip fallback for non-replayable bodies (#5770)
7581b75 
* chore(release): open v3.8.42 cycle

Bump version to 3.8.42, add CHANGELOG placeholder, sync openapi/electron/open-sse + 42 i18n CHANGELOG mirrors.

* chore: remove unused qdrant schema aliases (#5404)

Integrated into release/v3.8.42

* chore: remove unused memory schema aliases (#5403)

Integrated into release/v3.8.42

* chore: remove unused quota schema types (#5402)

Integrated into release/v3.8.42

* chore: remove unused playground row type (#5401)

Integrated into release/v3.8.42

* chore: remove unused codegraph exports (#5400)

Integrated into release/v3.8.42

* chore: remove unused notion client type (#5399)

Integrated into release/v3.8.42

* chore: remove unused settings types (#5398)

Integrated into release/v3.8.42

* chore: remove unused combo types (#5396)

Integrated into release/v3.8.42

* chore: remove unused provider types (#5393)

Integrated into release/v3.8.42

* chore: remove unused skillssh skill type (#5392)

Integrated into release/v3.8.42

* chore: remove unused status hex key type (#5391)

Integrated into release/v3.8.42

* chore: remove unused batch provider type (#5390)

Integrated into release/v3.8.42

* chore: remove unused skills schema types (#5389)

Integrated into release/v3.8.42

* chore: remove unused codex auth input type (#5388)

Integrated into release/v3.8.42

* chore: remove unused memory schema types (#5387)

Integrated into release/v3.8.42

* chore: remove unused playground row type (#5386)

Integrated into release/v3.8.42

* chore: remove unused qdrant schema types (#5385)

Integrated into release/v3.8.42

* chore: remove unused kiro social schema (#5384)

Integrated into release/v3.8.42

* chore: remove unused memory schema types (#5383)

Integrated into release/v3.8.42

* chore: remove unused audit action type (#5382)

Integrated into release/v3.8.42

* chore: remove unused agent skills schema types (#5381)

Integrated into release/v3.8.42

* chore: remove unused shared logger default export (#5380)

Integrated into release/v3.8.42

* chore: remove unused sse logger helpers (#5378)

Integrated into release/v3.8.42

* chore: remove unused sse model legacy helpers (#5377)

Integrated into release/v3.8.42

* chore: remove unused v1 search response schema (#5376)

Integrated into release/v3.8.42

* chore: remove unused cloud agent result schemas (#5375)

Integrated into release/v3.8.42

* chore: remove unused a2a routing logger readers (#5374)

Integrated into release/v3.8.42

* chore: remove unused webhook delivery detail export (#5372)

Integrated into release/v3.8.42

* chore: remove unused api key type (#5395)

Integrated into release/v3.8.42

* chore: remove unused usage types (#5397)

Integrated into release/v3.8.42

* chore: remove unused cloud agent input types (#5373)

Integrated into release/v3.8.42

* deps: bump electron from 42.4.1 to 42.5.1 in /electron (#5413)

Integrated into release/v3.8.42

* deps: bump the production group with 11 updates (#5414)

Integrated into release/v3.8.42

* fix: frame non-streaming JSON responses (#5416)

Integrated into release/v3.8.42

* fix(services): runNpm shell on win32 + prefix via env for Node 24 EINVAL (#5379) (#5474)

Node 24 refuses execFile of npm.cmd without a shell (nodejs/node#52554),
so embedded-service install (9Router/CLIProxy) failed with spawn EINVAL on
Windows. runNpm now enables shell on win32 only; to stay Hard-Rule-#13 safe
under a shell, the install --prefix is passed via npm_config_prefix (env)
instead of an argv path (survives spaces), and the user-supplied version is
constrained by SERVICE_VERSION_PATTERN at the route boundary.

* fix(cli): restore dist/tls-options.mjs to npm tarball (#5452) (#5503)

Closes #5452

* fix(dashboard): render onboarding wizard on /providers/new (#5427) (#5505)

Closes #5427

* fix(db): EBUSY-safe database import on Windows (#5406) (#5507)

Closes #5406

* chore: remove unused gamification streak exports (#5463)

* chore: remove unused headroom log tail export (#5464)

* chore(dead-code): remove unused prompt cache control helper (#5466)

* chore(duplication): share vscode metadata helpers (#5471)

* chore(duplication): share auth zip extractors (#5475)

* chore(duplication): share vscode tokenized request helper (#5479)

* chore(duplication): share quota strategy ranking helpers (#5482)

* chore(duplication): share recharts donut card (#5484)

* chore(duplication): share provider specific validation (#5485)

* chore(duplication): share batch response formatter (#5488)

* chore(duplication): share redis runtime helpers (#5490)

* chore(duplication): share version manager request parsing (#5492)

* chore(duplication): share media generation route helpers (#5493)

* chore(duplication): share settings transform schemas (#5496)

* chore(duplication): share relay stream finalizer (#5497)

* chore(duplication): share machine id fallback (#5498)

* chore(duplication): share node sqlite adapter (#5500)

* fix: treat terminal stream cancels as complete (#5491)

* fix post-merge ci regressions (#5467)

* fix: gate claude adaptive thinking defaults (#5480)

Co-authored-by: KooshaPari <koosha@example.com>

* fix(fallback): normalize provider error rule headers (#5473)

Co-authored-by: KooshaPari <koosha@example.com>

* fix(rate-limit): normalize queue refresh settings (#5499)

Co-authored-by: KooshaPari <koosha@example.com>

* chore(ci): add npm fetch-retry + release-freeze protocol (Hard Rule #21) (#5506)

- .npmrc: bump fetch-retries 2->5 with backoff so transient registry ECONNRESET during npm ci (electron-release, v3.8.41) retries instead of failing the job; applies repo-wide.
- CLAUDE.md Hard Rule #21: release-freeze coordination marker (label release-freeze) that campaign workflows honor before merging into the active release branch, preventing the mid-release commit races that forced CHANGELOG re-reconciliation in v3.8.40/v3.8.41.

* chore(duplication): share service install helpers (#5495)

Share service install helpers; re-add SERVICE_VERSION_PATTERN regex to the shared schema (dropped in extraction, #5474) + tests rejecting malformed versions.

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* chore(duplication): share proxy route handlers (#5472)

Share proxy route handlers; add resolveProxyLookupResponse regression test (3 branches + custom whereUsed param name).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* chore(duplication): share combo builder model options (#5477)

Share combo builder model options; add regression test locking custom-model source classification (manual->custom, api-sync->imported).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* chore(dead-code): ratchet dead code baseline (#5468)

Ratchet dead-code baseline to the true measured value (310 -> 225) after the v3.8.42 dead-code + duplication wave. Measured by check-dead-code.mjs on the tip.

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix(dashboard): provider-add UX — i18n labels, surface import warning, default key name (#5511)

* fix(dashboard): provider-add UX — real i18n labels, surface import warning, default key name (#5421 #5428 #5429 #5431 #5435)

Three rough edges in the Add-API-Key / model-import flow, all from the
provider-catalog audit:

1. Validation Model + Account ID form fields shipped untranslated i18n
   stub copy ('Validation Model Id Label', etc.) that rendered verbatim.
   Replaced with real copy in en.json.
2. Model import silently fell back to the cached/local catalog — the route
   returns a 'warning' field the import hook never read. New pure helper
   extractImportWarning surfaces it as a log line.
3. Required connection-name field defaulted to '' (let browser autofill
   inject garbage like 'wiw'); now defaults to 'main'.

Regression guard: tests/unit/provider-add-ux-i18n-import-warning.test.ts.

* fix(dashboard): compress AddApiKeyModal comment to keep file under frozen size cap

* fix(providers): align Muse Spark (Meta AI) cookie copy to ecto_1_sess (#5449) (#5513)

* fix(providers): align Muse Spark (Meta AI) cookie copy to ecto_1_sess (#5449)

The default Meta AI session cookie migrated from the retired abra_sess to
ecto_1_sess (META_AI_DEFAULT_COOKIE), but the provider form hint and one
401 auth-failure message still named abra_sess, telling users to paste a
cookie that no longer exists. Both strings now name ecto_1_sess.

Regression guard: tests/unit/muse-spark-cookie-copy-5449.test.ts.

* chore: reconcile CHANGELOG with release (keep #5449 + #5511 bullets)

* fix(providers): correct FriendliAI (serverless) + Novita (/openai/v1) endpoints (#5430 #5455) (#5515)

* fix(providers): correct FriendliAI (serverless) and Novita (/openai/v1) endpoints (#5430 #5455)

Both rejected valid keys, verified live with real provider keys:
- FriendliAI baseUrl was /dedicated/v1/... which 403s a serverless flp_* token;
  switched to /serverless/v1/... + serverless modelsUrl.
- Novita baseUrl was the legacy /v3/... with a typo'd model id ai-ai/...
  (both 404); switched to OpenAI-compat /openai/v1/... + meta-llama/llama-3.1-8b-instruct.

Regression guard: tests/unit/provider-endpoints-friendliai-novita.test.ts.

* chore: reconcile CHANGELOG with release (keep #5430/#5455 + prior bullets)

* fix(providers): gate import for tool-only providers + sanitize Coze validation error (#5420 #5426) (#5522)

#5420: the 'Import Models' button now hides for tool-only providers
(web search / web fetch) via a capability check over resolved serviceKinds,
not just the -search suffix — firecrawl/jina-reader (webFetch) no longer
show an Import button that 400s. No LLM/media provider is affected.

#5426: Coze key validation no longer leaks the raw upstream envelope
({code,msg,logId,from}) into the UI; the Coze error becomes a friendly
message, scoped to provider === 'coze' so no other provider is affected.

Regression guards: tests/unit/model-listing-capability-5420.test.ts,
tests/unit/coze-validation-error-5426.test.ts.

* fix(providers): correct LongCat free tier — GA LongCat-2.0, one-time 10M (KYC) (#5508)

LongCat's preview ended and the Flash-* line was retired (2026-05-29);
the API now exposes only the GA LongCat-2.0 (1M context, 128K output).
The free tier is a ONE-TIME 10M-token grant unlocked after account
signup + KYC verification — NOT a recurring daily/monthly allowance.
The catalog still described the retired preview/Flash models and a
recurring 150M / 5M-per-day budget; this corrects every reference.

Config / code:
- registry/longcat: model LongCat-2.0-Preview -> LongCat-2.0, name +
  comment reflect one-time 10M (KYC) and pay-as-you-go beyond it.
- freeModelCatalog: longcat-2.0-preview (150M, recurring-daily) ->
  LongCat-2.0 (10M, freeType one-time-initial via creditTokens).
- freeTierCatalog: drop longcat from the recurring-monthly budget map
  (one-time credits are excluded by that catalog's own rule).
- regional.ts freeNote: one-time 10M after signup + KYC, not recurring.
- providerCostData: longcat-flash-lite -> longcat-2.0 (pay-as-you-go
  0.75/2.95 per 1M, 10M free quota).
- validation probe model longcat -> LongCat-2.0.

Tests:
- free-tier-catalog: longcat now absent from FREE_TIER_BUDGETS;
  providerCount 22->21 (clean 21->20); documented total ~1.39B.
- tierResolver: sample model flash-lite -> LongCat-2.0.

Docs:
- README, PROVIDERS-GUIDE, FREE-TIERS-GUIDE, FREE_TIERS: 50M/day
  Flash-Lite -> one-time 10M LongCat-2.0 (KYC); 'No auth' -> API key + KYC.
- Regenerated PROVIDER_REFERENCE.md (picks up the new freeNote).

typecheck:core clean; changed-file lint 0 errors; docs-sync PASS.

* fix(providers): Bytez OpenAI-compat base URL + auth-only key validation (#5422) (#5528)

Bytez IS OpenAI-compatible at .../models/v2/openai/v1, but the registry
stored the bare .../models/v2 base, so validation's chat-probe hit
.../models/v2/chat/completions -> 404 -> 'endpoint not supported'.

Part A: registry baseUrl -> full OpenAI-compat chat path.
Part B: a Bytez account only serves catalog-provisioned models, so chat-probe
validation 404s even for valid keys. validateBytezProvider instead probes the
auth-only GET .../models/v2/list/tasks (200=valid, 401/403=invalid).

Verified live with a real key: list/tasks -> 200 (valid) / 401 (invalid).
Regression guard: tests/unit/bytez-validation-5422.test.ts.

* fix(providers): remove dead Phind provider + dedupe HuggingChat catalog listing (#5530)

Integrated into release/v3.8.42 (round 3). Dead Phind removal + HuggingChat dedupe, verified complete.

* fix: protect dynamic dashboard tests with CSRF (#5405)

Integrated into release/v3.8.42 (round 3). Reworked CSRF (HMAC-signed synchronized token).

* docs: clarify bifrost relay backend envs (#5520)

Integrated into release/v3.8.42 (round 3). Doc-only: bifrost relay envs.

* test(quota): guard Claude-Code identity version lockstep (Phase 2) (#5514)

Integrated into release/v3.8.42 (round 3). Claude-Code identity version lockstep guard.

* feat(compression): T02 — honest default-on pipeline inflation guard (H1) (#5527)

Integrated into release/v3.8.42 (round 3). T02 pipeline inflation guard

* feat(compression): T05/C2 — caveman dedup + ultra packs for de, fr, ja (#5529)

Integrated into release/v3.8.42 (round 3). T05/C2 caveman packs de/fr/ja

* feat(compression): T05/C6 — Chinese (zh / wenyan) caveman pack + detection (#5532)

Integrated into release/v3.8.42 (round 3). T05/C6 zh/wenyan pack + detection

* feat(compression): T07/R9 — gradle + dotnet RTK catalog filters (#5537)

Integrated into release/v3.8.42 (round 3). T07/R9 RTK gradle+dotnet filters

* refactor(dashboard): T11 — drop duplicate caveman on/off toggle from the compression settings tab (#5524)

Integrated into release/v3.8.42 (round 3). T11 consolidate duplicate caveman controls; i18n'd the panel hint string (source key).

* test relay routing fallback headers (#5526)

Integrated into release/v3.8.42 (round 3). Relay fallback header extraction + tests (drift-shed: dependabot #5415 commit dropped).

* fix(opencode-plugin): bump to 0.2.0 + auto-publish on release (#5363)

- Bump @omniroute/opencode-plugin from 0.1.0 to 0.2.0 so CI publishes
  the accumulated fixes (auto combos, schema fields, debug logging) that
  were merged after the initial 0.1.0 publish on May 24.
- Add auto-bump step in npm-publish.yml: detects if the plugin dir
  changed since the last release tag and auto-increments patch version,
  so the plugin never falls behind again on future releases.

Co-authored-by: herjarsa <herjarsa@users.noreply.github.com>

* [codex] add bifrost auto fallback cooldown (#5519)

Integrated into release/v3.8.42 (round 3). Bifrost auto fallback cooldown; header reconciled with #5526 helper + env-doc.

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix onboarding schema client import (#5525)

Integrated into release/v3.8.42 (round 3). Browser-safe onboarding schema import (drift-shed: dependabot #5415 dropped).

* docs: add relay backend strategy guide (#5547)

Port #5533 relay strategy guide to release/v3.8.42 (doc-only).

* fix(chatgpt-web): support GPT-5.5 Pro handoff (#5536)

Integrated into release/v3.8.42 (round 3). GPT-5.5 Pro async stream_handoff support (drift-shed: dependabot #5415 dropped).

* fix(providers): persist Configured filter across page reloads (#5510)

Integrated into release/v3.8.42 (round 3). Persist Configured filter across reloads; extracted shouldSyncProviderDisplayMode race guard + TDD test (Closes #4059).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix(mimocode): route per-account traffic through SOCKS5 proxy dispatchers (#5521)

Integrated into release/v3.8.42 (round 3). Per-account SOCKS5 dispatcher routing — completes #3837's stored proxy config with the actual undici dispatcher layer. Rebased onto .42 (dropped the CI-workflow-deletion commits; merged proxyUrlMap dispatch with #3837's acct.proxy storage).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix(chatgpt-web): portable SHA3-512 for sentinel PoW under Electron/BoringSSL (#5531) (#5540)

* fix(build): keep ioredis out of the client/CLI bundle via SPAWN_CAPABLE_PREFIXES leaf (#5546)

Fix the dast-smoke ioredis client-bundle regression (proven: dast-smoke green). Remaining reds are pre-existing base-reds/flakes (base.ts file-size, GOLDEN provider drift, shard-1 compression flakes) inherited by all PRs — not from this change.

* chore(release): finalize v3.8.42 CHANGELOG + cycle-close reconciliation

- Reconcile CHANGELOG.md for v3.8.42: 40 bullets covering all 89 commits
  since v3.8.41 (4 features, 26 fixes, 10 maintenance incl. 2 rollups for
  the 35-PR dead-code sweep + 17-PR DRY consolidation), dedup the merge-
  artifact duplicate New Features headers, set release date 2026-06-30.
- Sync 42 docs/i18n/*/CHANGELOG.md mirrors.
- Document 3 new chatgpt-web/TLS env vars in .env.example + ENVIRONMENT.md
  (OMNIROUTE_CGPT_WEB_PRO_TIMEOUT_MS, _PRO_POLL_INTERVAL_MS,
  OMNIROUTE_CHATGPT_STREAM_FIRST_BYTE_TIMEOUT_MS).
- Cycle-close ratchet rebaselines: eslintWarnings 4116->4121, file-size
  base.ts/chatgpt-web.ts/strategySelector.ts/chatgpt-web.test.ts (all
  inherited drift, justified inline).
- Regenerate provider translate-path golden snapshot for the merged
  bytez/friendliai/novita endpoint fixes.

* chore(changelog): cover #5415 dev-deps bump merged from main

The release/v3.8.42 ↔ main merge (c4c1b56) brought #5415 (development
dependency group, 9 updates) and #5533 (relay backend guide) from main.
#5533's content is already covered by the #5547 port bullet; add a
Maintenance bullet for #5415 and re-sync the 42 i18n CHANGELOG mirrors.

* test: relocate 2 orphaned test files to collected runner paths

check:test-discovery flagged two cycle-merged tests that no runner
collects (they never ran → false coverage confidence):
- compression-settings-tab-consolidation.test.tsx (#5524) → tests/unit/ui/
  (vitest UI runner collects tests/unit/ui/**/*.test.tsx); 3/3 pass.
- providers/providerPageStorage.test.ts (#5510) → tests/unit/dashboard/
  ('providers' is not a collected subdir; 'dashboard' is, same ../../../
  import depth); 30/30 pass under the node runner.

Both confirmed green when actually executed; no assertions weakened.

* fix(release): repair inherited base-red tests from #5480/#5527/#5427/#5521

The fast-path (PR->release/**) does not run the full unit+integration suites,
so four merged feature PRs shipped with stale/incorrect tests that only surface
on the release PR (PR->main). Repairs (features are correct; align tests to the
new behavior — no assertions weakened):

- #5480 (gate claude adaptive thinking): adaptive thinking is now injected only
  for a real Claude Code client (x-app:cli / claude-code UA), not for any bare
  Claude OAuth token. claude-thinking-tool-choice-guard + base-thinking-budget-5312
  now identify as a Claude Code client to exercise the adaptive path (3 tests).

- #5527 (T02 inflation guard): the guard reverts a stacked body that did not
  shrink in tokens. The bail-out/advancement fixtures used growth-appending mock
  engines; they now carry a droppable padding message the engines empty, so the
  body realistically shrinks and the marker assertions survive. bailout (5),
  stacked-async (3), engine-enabled-toggle (2).

- #5427 (render onboarding wizard at /providers/new): integration-wiring asserted
  the old redirect stub; now asserts the route renders ProviderOnboardingWizard.

- #5521 (mimocode SOCKS5 per-account proxy): the constructor's default account
  omitted the proxy field (undefined), breaking the 'all proxies null' backward
  compat guard. Default it to null, mirroring syncAccountsFromCredentials().

* fix(proxyfetch): skip fallback for non-replayable bodies

---------

Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: Jan Leon <Jan.gaschler@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Co-authored-by: KooshaPari <koosha@example.com>
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com>
Co-authored-by: herjarsa <herjarsa@users.noreply.github.com>
Co-authored-by: Arthur Bodera <abodera@gmail.com>
Co-authored-by: PizzaV <103120356+pizzav-xyz@users.noreply.github.com>
Co-authored-by: OpenClaw Auto <openclaw-auto@example.invalid>
@KooshaPari
KooshaPari deleted the codex/bifrost-failure-cooldown branch July 2, 2026 22:09
tkgo11 pushed a commit to tkgo11/OmniRoute that referenced this pull request Sep 23, 2026
@Ardem2025 @diegosouzapw
@JxnLexn @dependabot @rdself @KooshaPari KooshaPari @backryun @herjarsa @Thinkscape @pizzav-xyz OpenClaw Auto
fix(proxyfetch): skip fallback for non-replayable bodies (diegosouzap…
11b6839 
…w#5770)

* chore(release): open v3.8.42 cycle

Bump version to 3.8.42, add CHANGELOG placeholder, sync openapi/electron/open-sse + 42 i18n CHANGELOG mirrors.

* chore: remove unused qdrant schema aliases (diegosouzapw#5404)

Integrated into release/v3.8.42

* chore: remove unused memory schema aliases (diegosouzapw#5403)

Integrated into release/v3.8.42

* chore: remove unused quota schema types (diegosouzapw#5402)

Integrated into release/v3.8.42

* chore: remove unused playground row type (diegosouzapw#5401)

Integrated into release/v3.8.42

* chore: remove unused codegraph exports (diegosouzapw#5400)

Integrated into release/v3.8.42

* chore: remove unused notion client type (diegosouzapw#5399)

Integrated into release/v3.8.42

* chore: remove unused settings types (diegosouzapw#5398)

Integrated into release/v3.8.42

* chore: remove unused combo types (diegosouzapw#5396)

Integrated into release/v3.8.42

* chore: remove unused provider types (diegosouzapw#5393)

Integrated into release/v3.8.42

* chore: remove unused skillssh skill type (diegosouzapw#5392)

Integrated into release/v3.8.42

* chore: remove unused status hex key type (diegosouzapw#5391)

Integrated into release/v3.8.42

* chore: remove unused batch provider type (diegosouzapw#5390)

Integrated into release/v3.8.42

* chore: remove unused skills schema types (diegosouzapw#5389)

Integrated into release/v3.8.42

* chore: remove unused codex auth input type (diegosouzapw#5388)

Integrated into release/v3.8.42

* chore: remove unused memory schema types (diegosouzapw#5387)

Integrated into release/v3.8.42

* chore: remove unused playground row type (diegosouzapw#5386)

Integrated into release/v3.8.42

* chore: remove unused qdrant schema types (diegosouzapw#5385)

Integrated into release/v3.8.42

* chore: remove unused kiro social schema (diegosouzapw#5384)

Integrated into release/v3.8.42

* chore: remove unused memory schema types (diegosouzapw#5383)

Integrated into release/v3.8.42

* chore: remove unused audit action type (diegosouzapw#5382)

Integrated into release/v3.8.42

* chore: remove unused agent skills schema types (diegosouzapw#5381)

Integrated into release/v3.8.42

* chore: remove unused shared logger default export (diegosouzapw#5380)

Integrated into release/v3.8.42

* chore: remove unused sse logger helpers (diegosouzapw#5378)

Integrated into release/v3.8.42

* chore: remove unused sse model legacy helpers (diegosouzapw#5377)

Integrated into release/v3.8.42

* chore: remove unused v1 search response schema (diegosouzapw#5376)

Integrated into release/v3.8.42

* chore: remove unused cloud agent result schemas (diegosouzapw#5375)

Integrated into release/v3.8.42

* chore: remove unused a2a routing logger readers (diegosouzapw#5374)

Integrated into release/v3.8.42

* chore: remove unused webhook delivery detail export (diegosouzapw#5372)

Integrated into release/v3.8.42

* chore: remove unused api key type (diegosouzapw#5395)

Integrated into release/v3.8.42

* chore: remove unused usage types (diegosouzapw#5397)

Integrated into release/v3.8.42

* chore: remove unused cloud agent input types (diegosouzapw#5373)

Integrated into release/v3.8.42

* deps: bump electron from 42.4.1 to 42.5.1 in /electron (diegosouzapw#5413)

Integrated into release/v3.8.42

* deps: bump the production group with 11 updates (diegosouzapw#5414)

Integrated into release/v3.8.42

* fix: frame non-streaming JSON responses (diegosouzapw#5416)

Integrated into release/v3.8.42

* fix(services): runNpm shell on win32 + prefix via env for Node 24 EINVAL (diegosouzapw#5379) (diegosouzapw#5474)

Node 24 refuses execFile of npm.cmd without a shell (nodejs/node#52554),
so embedded-service install (9Router/CLIProxy) failed with spawn EINVAL on
Windows. runNpm now enables shell on win32 only; to stay Hard-Rule-diegosouzapw#13 safe
under a shell, the install --prefix is passed via npm_config_prefix (env)
instead of an argv path (survives spaces), and the user-supplied version is
constrained by SERVICE_VERSION_PATTERN at the route boundary.

* fix(cli): restore dist/tls-options.mjs to npm tarball (diegosouzapw#5452) (diegosouzapw#5503)

Closes diegosouzapw#5452

* fix(dashboard): render onboarding wizard on /providers/new (diegosouzapw#5427) (diegosouzapw#5505)

Closes diegosouzapw#5427

* fix(db): EBUSY-safe database import on Windows (diegosouzapw#5406) (diegosouzapw#5507)

Closes diegosouzapw#5406

* chore: remove unused gamification streak exports (diegosouzapw#5463)

* chore: remove unused headroom log tail export (diegosouzapw#5464)

* chore(dead-code): remove unused prompt cache control helper (diegosouzapw#5466)

* chore(duplication): share vscode metadata helpers (diegosouzapw#5471)

* chore(duplication): share auth zip extractors (diegosouzapw#5475)

* chore(duplication): share vscode tokenized request helper (diegosouzapw#5479)

* chore(duplication): share quota strategy ranking helpers (diegosouzapw#5482)

* chore(duplication): share recharts donut card (diegosouzapw#5484)

* chore(duplication): share provider specific validation (diegosouzapw#5485)

* chore(duplication): share batch response formatter (diegosouzapw#5488)

* chore(duplication): share redis runtime helpers (diegosouzapw#5490)

* chore(duplication): share version manager request parsing (diegosouzapw#5492)

* chore(duplication): share media generation route helpers (diegosouzapw#5493)

* chore(duplication): share settings transform schemas (diegosouzapw#5496)

* chore(duplication): share relay stream finalizer (diegosouzapw#5497)

* chore(duplication): share machine id fallback (diegosouzapw#5498)

* chore(duplication): share node sqlite adapter (diegosouzapw#5500)

* fix: treat terminal stream cancels as complete (diegosouzapw#5491)

* fix post-merge ci regressions (diegosouzapw#5467)

* fix: gate claude adaptive thinking defaults (diegosouzapw#5480)

Co-authored-by: KooshaPari <koosha@example.com>

* fix(fallback): normalize provider error rule headers (diegosouzapw#5473)

Co-authored-by: KooshaPari <koosha@example.com>

* fix(rate-limit): normalize queue refresh settings (diegosouzapw#5499)

Co-authored-by: KooshaPari <koosha@example.com>

* chore(ci): add npm fetch-retry + release-freeze protocol (Hard Rule diegosouzapw#21) (diegosouzapw#5506)

- .npmrc: bump fetch-retries 2->5 with backoff so transient registry ECONNRESET during npm ci (electron-release, v3.8.41) retries instead of failing the job; applies repo-wide.
- CLAUDE.md Hard Rule diegosouzapw#21: release-freeze coordination marker (label release-freeze) that campaign workflows honor before merging into the active release branch, preventing the mid-release commit races that forced CHANGELOG re-reconciliation in v3.8.40/v3.8.41.

* chore(duplication): share service install helpers (diegosouzapw#5495)

Share service install helpers; re-add SERVICE_VERSION_PATTERN regex to the shared schema (dropped in extraction, diegosouzapw#5474) + tests rejecting malformed versions.

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* chore(duplication): share proxy route handlers (diegosouzapw#5472)

Share proxy route handlers; add resolveProxyLookupResponse regression test (3 branches + custom whereUsed param name).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* chore(duplication): share combo builder model options (diegosouzapw#5477)

Share combo builder model options; add regression test locking custom-model source classification (manual->custom, api-sync->imported).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* chore(dead-code): ratchet dead code baseline (diegosouzapw#5468)

Ratchet dead-code baseline to the true measured value (310 -> 225) after the v3.8.42 dead-code + duplication wave. Measured by check-dead-code.mjs on the tip.

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix(dashboard): provider-add UX — i18n labels, surface import warning, default key name (diegosouzapw#5511)

* fix(dashboard): provider-add UX — real i18n labels, surface import warning, default key name (diegosouzapw#5421 diegosouzapw#5428 diegosouzapw#5429 diegosouzapw#5431 diegosouzapw#5435)

Three rough edges in the Add-API-Key / model-import flow, all from the
provider-catalog audit:

1. Validation Model + Account ID form fields shipped untranslated i18n
   stub copy ('Validation Model Id Label', etc.) that rendered verbatim.
   Replaced with real copy in en.json.
2. Model import silently fell back to the cached/local catalog — the route
   returns a 'warning' field the import hook never read. New pure helper
   extractImportWarning surfaces it as a log line.
3. Required connection-name field defaulted to '' (let browser autofill
   inject garbage like 'wiw'); now defaults to 'main'.

Regression guard: tests/unit/provider-add-ux-i18n-import-warning.test.ts.

* fix(dashboard): compress AddApiKeyModal comment to keep file under frozen size cap

* fix(providers): align Muse Spark (Meta AI) cookie copy to ecto_1_sess (diegosouzapw#5449) (diegosouzapw#5513)

* fix(providers): align Muse Spark (Meta AI) cookie copy to ecto_1_sess (diegosouzapw#5449)

The default Meta AI session cookie migrated from the retired abra_sess to
ecto_1_sess (META_AI_DEFAULT_COOKIE), but the provider form hint and one
401 auth-failure message still named abra_sess, telling users to paste a
cookie that no longer exists. Both strings now name ecto_1_sess.

Regression guard: tests/unit/muse-spark-cookie-copy-5449.test.ts.

* chore: reconcile CHANGELOG with release (keep diegosouzapw#5449 + diegosouzapw#5511 bullets)

* fix(providers): correct FriendliAI (serverless) + Novita (/openai/v1) endpoints (diegosouzapw#5430 diegosouzapw#5455) (diegosouzapw#5515)

* fix(providers): correct FriendliAI (serverless) and Novita (/openai/v1) endpoints (diegosouzapw#5430 diegosouzapw#5455)

Both rejected valid keys, verified live with real provider keys:
- FriendliAI baseUrl was /dedicated/v1/... which 403s a serverless flp_* token;
  switched to /serverless/v1/... + serverless modelsUrl.
- Novita baseUrl was the legacy /v3/... with a typo'd model id ai-ai/...
  (both 404); switched to OpenAI-compat /openai/v1/... + meta-llama/llama-3.1-8b-instruct.

Regression guard: tests/unit/provider-endpoints-friendliai-novita.test.ts.

* chore: reconcile CHANGELOG with release (keep diegosouzapw#5430/diegosouzapw#5455 + prior bullets)

* fix(providers): gate import for tool-only providers + sanitize Coze validation error (diegosouzapw#5420 diegosouzapw#5426) (diegosouzapw#5522)

diegosouzapw#5420: the 'Import Models' button now hides for tool-only providers
(web search / web fetch) via a capability check over resolved serviceKinds,
not just the -search suffix — firecrawl/jina-reader (webFetch) no longer
show an Import button that 400s. No LLM/media provider is affected.

diegosouzapw#5426: Coze key validation no longer leaks the raw upstream envelope
({code,msg,logId,from}) into the UI; the Coze error becomes a friendly
message, scoped to provider === 'coze' so no other provider is affected.

Regression guards: tests/unit/model-listing-capability-5420.test.ts,
tests/unit/coze-validation-error-5426.test.ts.

* fix(providers): correct LongCat free tier — GA LongCat-2.0, one-time 10M (KYC) (diegosouzapw#5508)

LongCat's preview ended and the Flash-* line was retired (2026-05-29);
the API now exposes only the GA LongCat-2.0 (1M context, 128K output).
The free tier is a ONE-TIME 10M-token grant unlocked after account
signup + KYC verification — NOT a recurring daily/monthly allowance.
The catalog still described the retired preview/Flash models and a
recurring 150M / 5M-per-day budget; this corrects every reference.

Config / code:
- registry/longcat: model LongCat-2.0-Preview -> LongCat-2.0, name +
  comment reflect one-time 10M (KYC) and pay-as-you-go beyond it.
- freeModelCatalog: longcat-2.0-preview (150M, recurring-daily) ->
  LongCat-2.0 (10M, freeType one-time-initial via creditTokens).
- freeTierCatalog: drop longcat from the recurring-monthly budget map
  (one-time credits are excluded by that catalog's own rule).
- regional.ts freeNote: one-time 10M after signup + KYC, not recurring.
- providerCostData: longcat-flash-lite -> longcat-2.0 (pay-as-you-go
  0.75/2.95 per 1M, 10M free quota).
- validation probe model longcat -> LongCat-2.0.

Tests:
- free-tier-catalog: longcat now absent from FREE_TIER_BUDGETS;
  providerCount 22->21 (clean 21->20); documented total ~1.39B.
- tierResolver: sample model flash-lite -> LongCat-2.0.

Docs:
- README, PROVIDERS-GUIDE, FREE-TIERS-GUIDE, FREE_TIERS: 50M/day
  Flash-Lite -> one-time 10M LongCat-2.0 (KYC); 'No auth' -> API key + KYC.
- Regenerated PROVIDER_REFERENCE.md (picks up the new freeNote).

typecheck:core clean; changed-file lint 0 errors; docs-sync PASS.

* fix(providers): Bytez OpenAI-compat base URL + auth-only key validation (diegosouzapw#5422) (diegosouzapw#5528)

Bytez IS OpenAI-compatible at .../models/v2/openai/v1, but the registry
stored the bare .../models/v2 base, so validation's chat-probe hit
.../models/v2/chat/completions -> 404 -> 'endpoint not supported'.

Part A: registry baseUrl -> full OpenAI-compat chat path.
Part B: a Bytez account only serves catalog-provisioned models, so chat-probe
validation 404s even for valid keys. validateBytezProvider instead probes the
auth-only GET .../models/v2/list/tasks (200=valid, 401/403=invalid).

Verified live with a real key: list/tasks -> 200 (valid) / 401 (invalid).
Regression guard: tests/unit/bytez-validation-5422.test.ts.

* fix(providers): remove dead Phind provider + dedupe HuggingChat catalog listing (diegosouzapw#5530)

Integrated into release/v3.8.42 (round 3). Dead Phind removal + HuggingChat dedupe, verified complete.

* fix: protect dynamic dashboard tests with CSRF (diegosouzapw#5405)

Integrated into release/v3.8.42 (round 3). Reworked CSRF (HMAC-signed synchronized token).

* docs: clarify bifrost relay backend envs (diegosouzapw#5520)

Integrated into release/v3.8.42 (round 3). Doc-only: bifrost relay envs.

* test(quota): guard Claude-Code identity version lockstep (Phase 2) (diegosouzapw#5514)

Integrated into release/v3.8.42 (round 3). Claude-Code identity version lockstep guard.

* feat(compression): T02 — honest default-on pipeline inflation guard (H1) (diegosouzapw#5527)

Integrated into release/v3.8.42 (round 3). T02 pipeline inflation guard

* feat(compression): T05/C2 — caveman dedup + ultra packs for de, fr, ja (diegosouzapw#5529)

Integrated into release/v3.8.42 (round 3). T05/C2 caveman packs de/fr/ja

* feat(compression): T05/C6 — Chinese (zh / wenyan) caveman pack + detection (diegosouzapw#5532)

Integrated into release/v3.8.42 (round 3). T05/C6 zh/wenyan pack + detection

* feat(compression): T07/R9 — gradle + dotnet RTK catalog filters (diegosouzapw#5537)

Integrated into release/v3.8.42 (round 3). T07/R9 RTK gradle+dotnet filters

* refactor(dashboard): T11 — drop duplicate caveman on/off toggle from the compression settings tab (diegosouzapw#5524)

Integrated into release/v3.8.42 (round 3). T11 consolidate duplicate caveman controls; i18n'd the panel hint string (source key).

* test relay routing fallback headers (diegosouzapw#5526)

Integrated into release/v3.8.42 (round 3). Relay fallback header extraction + tests (drift-shed: dependabot diegosouzapw#5415 commit dropped).

* fix(opencode-plugin): bump to 0.2.0 + auto-publish on release (diegosouzapw#5363)

- Bump @omniroute/opencode-plugin from 0.1.0 to 0.2.0 so CI publishes
  the accumulated fixes (auto combos, schema fields, debug logging) that
  were merged after the initial 0.1.0 publish on May 24.
- Add auto-bump step in npm-publish.yml: detects if the plugin dir
  changed since the last release tag and auto-increments patch version,
  so the plugin never falls behind again on future releases.

Co-authored-by: herjarsa <herjarsa@users.noreply.github.com>

* [codex] add bifrost auto fallback cooldown (diegosouzapw#5519)

Integrated into release/v3.8.42 (round 3). Bifrost auto fallback cooldown; header reconciled with diegosouzapw#5526 helper + env-doc.

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix onboarding schema client import (diegosouzapw#5525)

Integrated into release/v3.8.42 (round 3). Browser-safe onboarding schema import (drift-shed: dependabot diegosouzapw#5415 dropped).

* docs: add relay backend strategy guide (diegosouzapw#5547)

Port diegosouzapw#5533 relay strategy guide to release/v3.8.42 (doc-only).

* fix(chatgpt-web): support GPT-5.5 Pro handoff (diegosouzapw#5536)

Integrated into release/v3.8.42 (round 3). GPT-5.5 Pro async stream_handoff support (drift-shed: dependabot diegosouzapw#5415 dropped).

* fix(providers): persist Configured filter across page reloads (diegosouzapw#5510)

Integrated into release/v3.8.42 (round 3). Persist Configured filter across reloads; extracted shouldSyncProviderDisplayMode race guard + TDD test (Closes diegosouzapw#4059).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix(mimocode): route per-account traffic through SOCKS5 proxy dispatchers (diegosouzapw#5521)

Integrated into release/v3.8.42 (round 3). Per-account SOCKS5 dispatcher routing — completes diegosouzapw#3837's stored proxy config with the actual undici dispatcher layer. Rebased onto .42 (dropped the CI-workflow-deletion commits; merged proxyUrlMap dispatch with diegosouzapw#3837's acct.proxy storage).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix(chatgpt-web): portable SHA3-512 for sentinel PoW under Electron/BoringSSL (diegosouzapw#5531) (diegosouzapw#5540)

* fix(build): keep ioredis out of the client/CLI bundle via SPAWN_CAPABLE_PREFIXES leaf (diegosouzapw#5546)

Fix the dast-smoke ioredis client-bundle regression (proven: dast-smoke green). Remaining reds are pre-existing base-reds/flakes (base.ts file-size, GOLDEN provider drift, shard-1 compression flakes) inherited by all PRs — not from this change.

* chore(release): finalize v3.8.42 CHANGELOG + cycle-close reconciliation

- Reconcile CHANGELOG.md for v3.8.42: 40 bullets covering all 89 commits
  since v3.8.41 (4 features, 26 fixes, 10 maintenance incl. 2 rollups for
  the 35-PR dead-code sweep + 17-PR DRY consolidation), dedup the merge-
  artifact duplicate New Features headers, set release date 2026-06-30.
- Sync 42 docs/i18n/*/CHANGELOG.md mirrors.
- Document 3 new chatgpt-web/TLS env vars in .env.example + ENVIRONMENT.md
  (OMNIROUTE_CGPT_WEB_PRO_TIMEOUT_MS, _PRO_POLL_INTERVAL_MS,
  OMNIROUTE_CHATGPT_STREAM_FIRST_BYTE_TIMEOUT_MS).
- Cycle-close ratchet rebaselines: eslintWarnings 4116->4121, file-size
  base.ts/chatgpt-web.ts/strategySelector.ts/chatgpt-web.test.ts (all
  inherited drift, justified inline).
- Regenerate provider translate-path golden snapshot for the merged
  bytez/friendliai/novita endpoint fixes.

* chore(changelog): cover diegosouzapw#5415 dev-deps bump merged from main

The release/v3.8.42 ↔ main merge (783d1f4) brought diegosouzapw#5415 (development
dependency group, 9 updates) and diegosouzapw#5533 (relay backend guide) from main.
diegosouzapw#5533's content is already covered by the diegosouzapw#5547 port bullet; add a
Maintenance bullet for diegosouzapw#5415 and re-sync the 42 i18n CHANGELOG mirrors.

* test: relocate 2 orphaned test files to collected runner paths

check:test-discovery flagged two cycle-merged tests that no runner
collects (they never ran → false coverage confidence):
- compression-settings-tab-consolidation.test.tsx (diegosouzapw#5524) → tests/unit/ui/
  (vitest UI runner collects tests/unit/ui/**/*.test.tsx); 3/3 pass.
- providers/providerPageStorage.test.ts (diegosouzapw#5510) → tests/unit/dashboard/
  ('providers' is not a collected subdir; 'dashboard' is, same ../../../
  import depth); 30/30 pass under the node runner.

Both confirmed green when actually executed; no assertions weakened.

* fix(release): repair inherited base-red tests from diegosouzapw#5480/diegosouzapw#5527/diegosouzapw#5427/diegosouzapw#5521

The fast-path (PR->release/**) does not run the full unit+integration suites,
so four merged feature PRs shipped with stale/incorrect tests that only surface
on the release PR (PR->main). Repairs (features are correct; align tests to the
new behavior — no assertions weakened):

- diegosouzapw#5480 (gate claude adaptive thinking): adaptive thinking is now injected only
  for a real Claude Code client (x-app:cli / claude-code UA), not for any bare
  Claude OAuth token. claude-thinking-tool-choice-guard + base-thinking-budget-5312
  now identify as a Claude Code client to exercise the adaptive path (3 tests).

- diegosouzapw#5527 (T02 inflation guard): the guard reverts a stacked body that did not
  shrink in tokens. The bail-out/advancement fixtures used growth-appending mock
  engines; they now carry a droppable padding message the engines empty, so the
  body realistically shrinks and the marker assertions survive. bailout (5),
  stacked-async (3), engine-enabled-toggle (2).

- diegosouzapw#5427 (render onboarding wizard at /providers/new): integration-wiring asserted
  the old redirect stub; now asserts the route renders ProviderOnboardingWizard.

- diegosouzapw#5521 (mimocode SOCKS5 per-account proxy): the constructor's default account
  omitted the proxy field (undefined), breaking the 'all proxies null' backward
  compat guard. Default it to null, mirroring syncAccountsFromCredentials().

* fix(proxyfetch): skip fallback for non-replayable bodies

---------

Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: Jan Leon <Jan.gaschler@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Co-authored-by: KooshaPari <koosha@example.com>
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com>
Co-authored-by: herjarsa <herjarsa@users.noreply.github.com>
Co-authored-by: Arthur Bodera <abodera@gmail.com>
Co-authored-by: PizzaV <103120356+pizzav-xyz@users.noreply.github.com>
Co-authored-by: OpenClaw Auto <openclaw-auto@example.invalid>
tkgo11 pushed a commit to tkgo11/OmniRoute that referenced this pull request Sep 23, 2026
@KooshaPari @diegosouzapw
[codex] add bifrost auto fallback cooldown (diegosouzapw#5519)
2292789 
Integrated into release/v3.8.42 (round 3). Bifrost auto fallback cooldown; header reconciled with diegosouzapw#5526 helper + env-doc.

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@diegosouzapw diegosouzapw Awaiting requested review from diegosouzapw diegosouzapw is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@KooshaPari @diegosouzapw @JxnLexn @rdself @backryun @herjarsa