Skip to content

feat: adds provider cache and semantic cache attributes in metrics export - #3816

Merged
akshaydeo merged 1 commit into
devfrom
05-27-feat_adds_provider_cache_and_semantic_cache_attributes_in_metrics_export
May 27, 2026
Merged

akshaydeo merged 1 commit into
devfrom
05-27-feat_adds_provider_cache_and_semantic_cache_attributes_in_metrics_export

Conversation

@roroghost17

@roroghost17 roroghost17 commented May 27, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds provider-side prompt cache token metrics (cache_read, cache_write, cache_write_5m, cache_write_1h) to both the Prometheus and OTEL telemetry plugins. These are distinct from the existing cache_hits_total counter, which tracks Bifrost's own semantic-cache hits. Also fixes the OTEL plugin's PostLLMHook (previously a no-op) to correctly emit cache-hit metrics for semantic-cache responses that short-circuit before any provider span is created.

Changes

  • Prometheus plugin: Added four new CounterVec metrics — bifrost_cache_read_input_tokens_total, bifrost_cache_write_input_tokens_total, bifrost_cache_write_input_tokens_5m_total, and bifrost_cache_write_input_tokens_1h_total. A new extractProviderCacheTokens helper reads these values from PromptTokensDetails (Chat/TextCompletion) or InputTokensDetails (Responses API) and emits them in PostLLMHook.
  • OTEL plugin: Implemented the same four provider cache token counters and their Record* methods on MetricsExporter. The previously no-op PostLLMHook now emits the semantic cache-hit metric using a new buildContextAttrs helper that sources dimensions from request context rather than a span (since cache hits have no provider span). Provider cache token counts are recorded in recordMetricsFromTrace from span attributes, covering both the unified read/write keys and the Anthropic-specific 5m/1h TTL breakdown keys.
  • Schema mux: Propagated CachedWriteTokenDetails through both ToResponsesResponseUsage and ToBifrostLLMUsage conversion functions so the TTL breakdown is preserved across API format conversions.
  • The 5m/1h counters are explicitly documented as subsets of the write total and should not be summed with it.

Type of change

  • Bug fix
  • Feature
  • Refactor
  • Documentation
  • Chore/CI

Affected areas

  • Core (Go)
  • Transports (HTTP)
  • Providers/Integrations
  • Plugins
  • UI (React)
  • Docs

How to test

go test ./...
  • Configure a provider that supports prompt caching (e.g. Anthropic, OpenAI).
  • Send requests that exercise prompt cache reads and writes.
  • Verify the following metrics are emitted with non-zero values:
    • bifrost_cache_read_input_tokens_total
    • bifrost_cache_write_input_tokens_total
    • bifrost_cache_write_input_tokens_5m_total (Anthropic only)
    • bifrost_cache_write_input_tokens_1h_total (Anthropic only)
  • Trigger a semantic cache hit and verify bifrost_cache_hits_total increments exactly once (not double-counted).

Breaking changes

  • Yes
  • No

Related issues

Security considerations

None.

Checklist

  • I read docs/contributing/README.md and followed the guidelines
  • I added/updated tests where appropriate
  • I updated documentation where needed
  • I verified builds succeed (Go and UI)
  • I verified the CI pipeline passes locally if applicable

@CLAassistant

CLAassistant commented May 27, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@coderabbitai

coderabbitai Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d1e11026-cf45-4a6a-8896-557983578fb1

📥 Commits

Reviewing files that changed from the base of the PR and between 4f6a8b2 and ba11b9a.

⛔ Files ignored due to path filters (1)
  • flake.lock is excluded by !**/*.lock
📒 Files selected for processing (4)
  • core/schemas/mux.go
  • plugins/otel/main.go
  • plugins/otel/metrics.go
  • plugins/telemetry/main.go
🚧 Files skipped from review as they are similar to previous changes (4)
  • plugins/otel/metrics.go
  • core/schemas/mux.go
  • plugins/otel/main.go
  • plugins/telemetry/main.go

📝 Walkthrough

Summary by CodeRabbit

  • New Features

    • Added telemetry metrics for provider-side prompt-cache token operations: cache reads, cache writes, and TTL-specific (5m/1h) write breakdowns
    • Emit cache-hit events to observability systems for semantic-cache monitoring
  • Improvements

    • Propagated richer token-usage details through usage conversions to improve cache analytics and reporting

Walkthrough

Adds provider-side prompt-cache token metrics and cache-hit recording: schema conversions propagate CachedWriteTokenDetails; OpenTelemetry exporter gains cache read/write counters and hook recording; Prometheus plugin adds matching CounterVec metrics and records provider cache token counts.

Changes

Provider-side prompt cache token metrics tracking

Layer / File(s) Summary
Cached write token detail propagation
core/schemas/mux.go
BifrostLLMUsage.ToResponsesResponseUsage() and ResponsesResponseUsage.ToBifrostLLMUsage() now map CachedWriteTokenDetails in both directions.
OpenTelemetry metrics infrastructure
plugins/otel/metrics.go
MetricsExporter adds four new counters for provider-side cache read/write input tokens and 5m/1h write-token subsets; initMetrics() registers them and new methods record counts.
OpenTelemetry hook and trace metrics
plugins/otel/main.go
Adds bifrost import; PostLLMHook() records cache-hit metrics when present using buildContextAttrs(); recordMetricsFromTrace() records provider cache token metrics from final attempt spans.
Prometheus metrics infrastructure
plugins/telemetry/main.go
PrometheusPlugin adds four CounterVec fields for cache read/write input tokens and Anthropic 5m/1h write breakdowns; Init() registers them and wires them into the plugin.
Prometheus hook integration
plugins/telemetry/main.go
Adds extractProviderCacheTokens() to pull cached-read/cached-write token counts (and optional TTL breakdowns) from multiple response shapes; PostLLMHook() increments the new counters when values are present.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested reviewers

  • akshaydeo
  • danpiths

Poem

🐰 Cache tokens dance in metrics light,
Write and read, both tracked just right,
OTel and Prometheus unite,
Five-minute TTLs burning bright!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically describes the main change: adding provider cache and semantic cache attributes to metrics export, which aligns with the core objectives of the PR.
Description check ✅ Passed The PR description is comprehensive and well-structured, covering all major sections of the template including Summary, Changes, Type of change, Affected areas, How to test, Breaking changes, and Security considerations.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch 05-27-feat_adds_provider_cache_and_semantic_cache_attributes_in_metrics_export

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"


Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

@roroghost17
roroghost17 marked this pull request as ready for review May 27, 2026 14:23
@greptile-apps

greptile-apps Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Confidence Score: 5/5

This PR is safe to merge — the changes are additive metric instrumentation with no modifications to request routing, auth, or data persistence paths.

All four new counters are guarded before recording, the OTEL PostLLMHook and recordMetricsFromTrace touch strictly disjoint code paths, and the schema propagation in mux.go mirrors the existing field-mapping pattern exactly.

No files require special attention.

Important Files Changed

Filename Overview
core/schemas/mux.go Propagates CachedWriteTokenDetails through both ToResponsesResponseUsage and ToBifrostLLMUsage; straightforward field additions mirroring the existing mapping pattern with no issues.
plugins/otel/metrics.go Adds four new syncInt64Counter fields and Record* methods for provider-side prompt cache tokens; follows existing initialization and method patterns consistently.
plugins/otel/main.go Implements PostLLMHook for semantic-cache hit metrics and adds provider cache token recording in recordMetricsFromTrace; no double-counting concern.
plugins/telemetry/main.go Adds four new CounterVec metrics and extractProviderCacheTokens helper; all counters are guarded with > 0 checks before recording.
flake.lock Routine nixpkgs pin bump; no code changes.

Reviews (2): Last reviewed commit: "feat: adds provider cache and semantic c..." | Re-trigger Greptile

Comment thread plugins/telemetry/main.go Outdated
Comment thread plugins/telemetry/main.go
coderabbitai[bot]
coderabbitai Bot previously approved these changes May 27, 2026
@roroghost17
roroghost17 force-pushed the 05-27-feat_adds_provider_cache_and_semantic_cache_attributes_in_metrics_export branch from 4f6a8b2 to ba11b9a Compare May 27, 2026 15:28
@coderabbitai
coderabbitai Bot requested review from akshaydeo and danpiths May 27, 2026 15:30

akshaydeo commented May 27, 2026

Copy link
Copy Markdown
Contributor

Merge activity

  • May 27, 7:16 PM UTC: A user started a stack merge that includes this pull request via Graphite.
  • May 27, 7:16 PM UTC: @akshaydeo merged this pull request with Graphite.

@akshaydeo
akshaydeo merged commit c665405 into dev May 27, 2026
14 of 15 checks passed
@akshaydeo
akshaydeo deleted the 05-27-feat_adds_provider_cache_and_semantic_cache_attributes_in_metrics_export branch May 27, 2026 19:16
akshaydeo pushed a commit that referenced this pull request May 29, 2026
…port (#3816)

## Summary

Adds provider-side prompt cache token metrics (`cache_read`, `cache_write`, `cache_write_5m`, `cache_write_1h`) to both the Prometheus and OTEL telemetry plugins. These are distinct from the existing `cache_hits_total` counter, which tracks Bifrost's own semantic-cache hits. Also fixes the OTEL plugin's `PostLLMHook` (previously a no-op) to correctly emit cache-hit metrics for semantic-cache responses that short-circuit before any provider span is created.

## Changes

- **Prometheus plugin**: Added four new `CounterVec` metrics — `bifrost_cache_read_input_tokens_total`, `bifrost_cache_write_input_tokens_total`, `bifrost_cache_write_input_tokens_5m_total`, and `bifrost_cache_write_input_tokens_1h_total`. A new `extractProviderCacheTokens` helper reads these values from `PromptTokensDetails` (Chat/TextCompletion) or `InputTokensDetails` (Responses API) and emits them in `PostLLMHook`.
- **OTEL plugin**: Implemented the same four provider cache token counters and their `Record*` methods on `MetricsExporter`. The previously no-op `PostLLMHook` now emits the semantic cache-hit metric using a new `buildContextAttrs` helper that sources dimensions from request context rather than a span (since cache hits have no provider span). Provider cache token counts are recorded in `recordMetricsFromTrace` from span attributes, covering both the unified read/write keys and the Anthropic-specific 5m/1h TTL breakdown keys.
- **Schema mux**: Propagated `CachedWriteTokenDetails` through both `ToResponsesResponseUsage` and `ToBifrostLLMUsage` conversion functions so the TTL breakdown is preserved across API format conversions.
- The 5m/1h counters are explicitly documented as subsets of the write total and should not be summed with it.

## Type of change

- [ ] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [ ] Chore/CI

## Affected areas

- [x] Core (Go)
- [ ] Transports (HTTP)
- [ ] Providers/Integrations
- [x] Plugins
- [ ] UI (React)
- [ ] Docs

## How to test

```sh
go test ./...
```

- Configure a provider that supports prompt caching (e.g. Anthropic, OpenAI).
- Send requests that exercise prompt cache reads and writes.
- Verify the following metrics are emitted with non-zero values:
  - `bifrost_cache_read_input_tokens_total`
  - `bifrost_cache_write_input_tokens_total`
  - `bifrost_cache_write_input_tokens_5m_total` (Anthropic only)
  - `bifrost_cache_write_input_tokens_1h_total` (Anthropic only)
- Trigger a semantic cache hit and verify `bifrost_cache_hits_total` increments exactly once (not double-counted).

## Breaking changes

- [ ] Yes
- [x] No

## Related issues

## Security considerations

None.

## Checklist

- [ ] I read `docs/contributing/README.md` and followed the guidelines
- [ ] I added/updated tests where appropriate
- [ ] I updated documentation where needed
- [ ] I verified builds succeed (Go and UI)
- [ ] I verified the CI pipeline passes locally if applicable
@akshaydeo akshaydeo mentioned this pull request May 29, 2026
18 tasks
akshaydeo added a commit that referenced this pull request May 29, 2026
## Summary

This PR releases **core v1.5.14**, **framework v1.3.14**, **transports v1.5.6**, and bumps all dependent plugins to their respective `.14` patch versions. It delivers a broad set of new capabilities across MCP authentication, key rotation, OTel metrics, Bedrock/Anthropic compatibility, and UI improvements, alongside a number of targeted bug fixes and refactors.

## Changes

- **Direct API Key Header** — Providers can now receive an API key passed directly via a request header (#3817)
- **MCP Per-User Auth** — Introduced `MCPCredentialStore` abstraction, per-user MCP credential reconciliation, and a new per-user header auth type with lazy-auth submission flow (#3656, #3702, #3703, #3704, #3705)
- **MCP TLS Configuration** — Added configurable TLS (`insecureSkipVerify`, `caCertPem`) for HTTP/SSE MCP client connections (#3779, #3783)
- **MCP Sessions Management** — Filter, search, and pagination on the MCP sessions list API and table, plus a `can_reauth` identity gate (#3823, #3824, #3825)
- **Key Rotation** — Keys now rotate on 401/402/403 responses; returns `502 upstream_credentials_exhausted` when all keys are permanently exhausted. Added `triggered_rotation` to `KeyAttemptRecord` and tightened `bifrost_key_rotation_events_total` semantics (#3430, #3491)
- **OTel Metrics** — Added OTel spec-compatible metrics (backward compatible) with provider cache and semantic cache attributes in metrics export (#3865, #3816)
- **Opus 4.8 Support** — System message handling and general compatibility for Opus 4.8 (#3868, #3878)
- **Dimension Rankings** — New `GetDimensionRankings` API and dashboard tabs for team, customer, BU, and user rankings (#3766)
- **Model Pricing Attributes** — `additional_attributes` field on model pricing rows with management API and UI editor (#3829)
- **Prompt Cache Retention** — Added prompt cache retention parameter on responses requests (#3810)
- **Tool Call Execution UI** — Inline tool-call execution, stop streaming, bulk execute/submit, and a redesigned tool-call UI (#3837, #3843)
- **Sheet Navigation** — Prev/next keyboard navigation and URL state across virtual key, MCP client, and routing rule sheets (#3739, #3740, #3744, #3745)
- **Bedrock Tool Name Truncation** — Truncate Bedrock function/tool names to the provider length limit
- **Bedrock Guardrails** — Set guardrail config in Bedrock requests built from responses (#3862)
- **Anthropic Tool Use** — Default `tool_use` input to `{}` when arguments are absent (#3880)
- **Responses Streaming** — Fixed responses stream events (#3838)
- **Compat Flow** — Fixed missing parameter parsing on the compat flow (#3881)
- **Passthrough API Version** — Set a default API version in passthrough requests as a fallback (#3853)
- **Virtual Key Updates** — Avoid overriding optional fields during virtual key update (#3855)
- **User-Mode Flows** — Gate user-mode flows on caller `user_id`, skip temp token mint, and unify flow/credential kind filtering for pending flows (#3841, #3859)
- **Partial Tool Calls** — Handle partial tool call execution failures and return successful results (#3849)
- **URL Query Escaping** — Support escaped characters in URL query parameters (#3826)
- **MCP Auth Errors** — Inline banner and retry support for MCP auth-required errors (#3856)
- **Renamed Resolvers** — `staticHeadersResolver`/`serverOAuthResolver` renamed to `sharedHeadersResolver`/`sharedOAuthResolver` (#3840)
- **Starlark Nested Tool Calls** — Exposed `RunWithPluginPipeline` on `ClientManager` and routed Starlark nested tool calls through the canonical plugin gate (#3794)
- **Deferred-Fill OAuth Removed** — Removed deferred-fill user-mode OAuth flow support (#3839)
- **Go 1.26.3** — Upgraded toolchain to Go 1.26.3 (#3782)

## Type of change

- [x] Bug fix
- [x] Feature
- [x] Refactor
- [ ] Documentation
- [x] Chore/CI

## Affected areas

- [x] Core (Go)
- [x] Transports (HTTP)
- [x] Providers/Integrations
- [x] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

```sh
# Core/Transports
go version  # should report go1.26.3
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build
```

- Validate MCP per-user auth by configuring a per-user header auth type and confirming credentials are stored and reconciled on virtual key and MCP client changes.
- Validate key rotation by triggering a 401/402/403 from an upstream provider and confirming rotation occurs; exhaust all keys and confirm a `502 upstream_credentials_exhausted` is returned.
- Validate OTel metrics output includes `provider_cache` and `semantic_cache` attributes.
- Validate Bedrock requests with tool names exceeding the provider limit are truncated correctly.
- Validate Opus 4.8 system message handling by sending a request with a system message to an Opus 4.8 endpoint.

## Breaking changes

- [x] Yes
- [ ] No

The deferred-fill user-mode OAuth flow has been removed (#3839). Any integrations relying on that flow must migrate to the new per-user credential store approach. The `staticHeadersResolver` and `serverOAuthResolver` identifiers have been renamed to `sharedHeadersResolver` and `sharedOAuthResolver` respectively (#3840); any direct references must be updated.

## Related issues

#3817, #3656, #3702, #3703, #3704, #3705, #3779, #3783, #3823, #3824, #3825, #3430, #3491, #3865, #3816, #3868, #3878, #3766, #3829, #3810, #3837, #3843, #3739, #3740, #3744, #3745, #3862, #3880, #3838, #3881, #3853, #3855, #3841, #3859, #3849, #3826, #3856, #3840, #3794, #3839, #3782, #3724, #3814, #3836, #3869, #3886

## Security considerations

- MCP per-user credentials are stored via the new `MCPCredentialStore` abstraction; ensure the backing store is appropriately access-controlled and that credential values are encrypted at rest.
- The direct API key header feature passes provider secrets via HTTP headers; ensure TLS is enforced on all ingress paths and that headers are not logged in plaintext.
- User-mode flows are now gated on `caller user_id` and temp token minting is skipped where appropriate, reducing the surface for privilege escalation.
- TLS configuration for MCP HTTP/SSE connections supports `insecureSkipVerify`; this should only be enabled in controlled environments.

## Checklist

- [x] I read `docs/contributing/README.md` and followed the guidelines
- [x] I added/updated tests where appropriate
- [x] I updated documentation where needed
- [x] I verified builds succeed (Go and UI)
- [x] I verified the CI pipeline passes locally if applicable
@akshaydeo akshaydeo mentioned this pull request May 29, 2026
akshaydeo added a commit that referenced this pull request May 29, 2026
## ✨ Features

- **Direct API Key Header** - Pass a provider API key directly via
request header (#3817)
- **MCP Per-User Authentication** - New per-user header auth type with
credential storage
  and lazy-auth submission flow (#3703, #3704, #3705)
- **MCP TLS Configuration** - Configurable TLS (insecureSkipVerify,
caCertPem) for HTTP/SSE
  MCP client connections (#3779, #3783)
- **MCP Sessions Management** - Filter, search, and pagination on the
MCP sessions list API
  and table, plus a can_reauth identity gate (#3823, #3824, #3825)
- **Tool Call Execution UI** - Inline tool-call execution, stop
streaming, bulk
  execute/submit, and a redesigned tool-call UI (#3837, #3843)
- **Dimension Rankings Dashboard** - New dashboard tabs for team,
customer, BU, and user
  rankings, backed by a GetDimensionRankings API (#3766)
- **Model Pricing Attributes** - additional_attributes on model pricing
rows with management
  API and UI editor (#3829)
- **Prompt Cache Retention** - Prompt cache retention parameter on
responses requests
  (#3810)
- **Opus 4.8 Support** - System message handling and compatibility for
Opus 4.8 (#3878,
  #3868)
  - **Key Rotation** - Rotate keys on 401/402/403 and return 502
upstream_credentials_exhausted when all keys are permanently dead
(#3491)
- **OTel Metrics** - OTel spec compatible metrics plus provider and
semantic cache
  attributes in metrics export (#3865, #3816)
- **Sheet Navigation** - Prev/next keyboard navigation and URL state
across virtual key, MCP
  client, and routing rule sheets (#3739, #3740, #3744, #3745)
  - **Go 1.26.3** - Upgraded toolchain to Go 1.26.3 (#3782)

  ## 🐞 Fixed

- **Bedrock Tool Names** - Truncate Bedrock function/tool names to the
provider length limit
- **Bedrock Guardrails** - Set guardrail config in Bedrock request built
from responses
  (#3862)
- **Anthropic Tool Use** - Default Anthropic tool_use input to {} when
arguments are absent
  (#3880)
  - **Responses Streaming** - Fixed responses stream events (#3838)
- **Compat Flow** - Fixed missing parameter parsing on the compat flow
(#3881)
- **Passthrough API Version** - Set a default API version in passthrough
requests as a
  fallback (#3853)
- **Virtual Key Updates** - Avoid overriding optional fields during
virtual key update
  (#3855)
- **User-Mode Flows** - Gate user-mode flows on caller user_id, skip
temp token mint, and
  unify flow/credential kind filtering for pending flows (#3841, #3859)
- **Partial Tool Calls** - Handle partial tool call execution failures
and return successful
  results (#3849)
- **URL Query Escaping** - Support escaped characters in URL query
parameters (#3826)
- **MCP Auth Errors** - Inline banner and retry support for MCP
auth-required errors (#3856)
- **JSON Editor Height** - Cap JSON editor max height at 400px in
message views (#3842)
akhsaul pushed a commit to akhsaul/bifrost that referenced this pull request Aug 27, 2026
…port (maximhq#3816)

## Summary

Adds provider-side prompt cache token metrics (`cache_read`, `cache_write`, `cache_write_5m`, `cache_write_1h`) to both the Prometheus and OTEL telemetry plugins. These are distinct from the existing `cache_hits_total` counter, which tracks Bifrost's own semantic-cache hits. Also fixes the OTEL plugin's `PostLLMHook` (previously a no-op) to correctly emit cache-hit metrics for semantic-cache responses that short-circuit before any provider span is created.

## Changes

- **Prometheus plugin**: Added four new `CounterVec` metrics — `bifrost_cache_read_input_tokens_total`, `bifrost_cache_write_input_tokens_total`, `bifrost_cache_write_input_tokens_5m_total`, and `bifrost_cache_write_input_tokens_1h_total`. A new `extractProviderCacheTokens` helper reads these values from `PromptTokensDetails` (Chat/TextCompletion) or `InputTokensDetails` (Responses API) and emits them in `PostLLMHook`.
- **OTEL plugin**: Implemented the same four provider cache token counters and their `Record*` methods on `MetricsExporter`. The previously no-op `PostLLMHook` now emits the semantic cache-hit metric using a new `buildContextAttrs` helper that sources dimensions from request context rather than a span (since cache hits have no provider span). Provider cache token counts are recorded in `recordMetricsFromTrace` from span attributes, covering both the unified read/write keys and the Anthropic-specific 5m/1h TTL breakdown keys.
- **Schema mux**: Propagated `CachedWriteTokenDetails` through both `ToResponsesResponseUsage` and `ToBifrostLLMUsage` conversion functions so the TTL breakdown is preserved across API format conversions.
- The 5m/1h counters are explicitly documented as subsets of the write total and should not be summed with it.

## Type of change

- [ ] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [ ] Chore/CI

## Affected areas

- [x] Core (Go)
- [ ] Transports (HTTP)
- [ ] Providers/Integrations
- [x] Plugins
- [ ] UI (React)
- [ ] Docs

## How to test

```sh
go test ./...
```

- Configure a provider that supports prompt caching (e.g. Anthropic, OpenAI).
- Send requests that exercise prompt cache reads and writes.
- Verify the following metrics are emitted with non-zero values:
  - `bifrost_cache_read_input_tokens_total`
  - `bifrost_cache_write_input_tokens_total`
  - `bifrost_cache_write_input_tokens_5m_total` (Anthropic only)
  - `bifrost_cache_write_input_tokens_1h_total` (Anthropic only)
- Trigger a semantic cache hit and verify `bifrost_cache_hits_total` increments exactly once (not double-counted).

## Breaking changes

- [ ] Yes
- [x] No

## Related issues

## Security considerations

None.

## Checklist

- [ ] I read `docs/contributing/README.md` and followed the guidelines
- [ ] I added/updated tests where appropriate
- [ ] I updated documentation where needed
- [ ] I verified builds succeed (Go and UI)
- [ ] I verified the CI pipeline passes locally if applicable
akhsaul pushed a commit to akhsaul/bifrost that referenced this pull request Aug 27, 2026
## Summary

This PR releases **core v1.5.14**, **framework v1.3.14**, **transports v1.5.6**, and bumps all dependent plugins to their respective `.14` patch versions. It delivers a broad set of new capabilities across MCP authentication, key rotation, OTel metrics, Bedrock/Anthropic compatibility, and UI improvements, alongside a number of targeted bug fixes and refactors.

## Changes

- **Direct API Key Header** — Providers can now receive an API key passed directly via a request header (maximhq#3817)
- **MCP Per-User Auth** — Introduced `MCPCredentialStore` abstraction, per-user MCP credential reconciliation, and a new per-user header auth type with lazy-auth submission flow (maximhq#3656, maximhq#3702, maximhq#3703, maximhq#3704, maximhq#3705)
- **MCP TLS Configuration** — Added configurable TLS (`insecureSkipVerify`, `caCertPem`) for HTTP/SSE MCP client connections (maximhq#3779, maximhq#3783)
- **MCP Sessions Management** — Filter, search, and pagination on the MCP sessions list API and table, plus a `can_reauth` identity gate (maximhq#3823, maximhq#3824, maximhq#3825)
- **Key Rotation** — Keys now rotate on 401/402/403 responses; returns `502 upstream_credentials_exhausted` when all keys are permanently exhausted. Added `triggered_rotation` to `KeyAttemptRecord` and tightened `bifrost_key_rotation_events_total` semantics (maximhq#3430, maximhq#3491)
- **OTel Metrics** — Added OTel spec-compatible metrics (backward compatible) with provider cache and semantic cache attributes in metrics export (maximhq#3865, maximhq#3816)
- **Opus 4.8 Support** — System message handling and general compatibility for Opus 4.8 (maximhq#3868, maximhq#3878)
- **Dimension Rankings** — New `GetDimensionRankings` API and dashboard tabs for team, customer, BU, and user rankings (maximhq#3766)
- **Model Pricing Attributes** — `additional_attributes` field on model pricing rows with management API and UI editor (maximhq#3829)
- **Prompt Cache Retention** — Added prompt cache retention parameter on responses requests (maximhq#3810)
- **Tool Call Execution UI** — Inline tool-call execution, stop streaming, bulk execute/submit, and a redesigned tool-call UI (maximhq#3837, maximhq#3843)
- **Sheet Navigation** — Prev/next keyboard navigation and URL state across virtual key, MCP client, and routing rule sheets (maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745)
- **Bedrock Tool Name Truncation** — Truncate Bedrock function/tool names to the provider length limit
- **Bedrock Guardrails** — Set guardrail config in Bedrock requests built from responses (maximhq#3862)
- **Anthropic Tool Use** — Default `tool_use` input to `{}` when arguments are absent (maximhq#3880)
- **Responses Streaming** — Fixed responses stream events (maximhq#3838)
- **Compat Flow** — Fixed missing parameter parsing on the compat flow (maximhq#3881)
- **Passthrough API Version** — Set a default API version in passthrough requests as a fallback (maximhq#3853)
- **Virtual Key Updates** — Avoid overriding optional fields during virtual key update (maximhq#3855)
- **User-Mode Flows** — Gate user-mode flows on caller `user_id`, skip temp token mint, and unify flow/credential kind filtering for pending flows (maximhq#3841, maximhq#3859)
- **Partial Tool Calls** — Handle partial tool call execution failures and return successful results (maximhq#3849)
- **URL Query Escaping** — Support escaped characters in URL query parameters (maximhq#3826)
- **MCP Auth Errors** — Inline banner and retry support for MCP auth-required errors (maximhq#3856)
- **Renamed Resolvers** — `staticHeadersResolver`/`serverOAuthResolver` renamed to `sharedHeadersResolver`/`sharedOAuthResolver` (maximhq#3840)
- **Starlark Nested Tool Calls** — Exposed `RunWithPluginPipeline` on `ClientManager` and routed Starlark nested tool calls through the canonical plugin gate (maximhq#3794)
- **Deferred-Fill OAuth Removed** — Removed deferred-fill user-mode OAuth flow support (maximhq#3839)
- **Go 1.26.3** — Upgraded toolchain to Go 1.26.3 (maximhq#3782)

## Type of change

- [x] Bug fix
- [x] Feature
- [x] Refactor
- [ ] Documentation
- [x] Chore/CI

## Affected areas

- [x] Core (Go)
- [x] Transports (HTTP)
- [x] Providers/Integrations
- [x] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

```sh
# Core/Transports
go version  # should report go1.26.3
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build
```

- Validate MCP per-user auth by configuring a per-user header auth type and confirming credentials are stored and reconciled on virtual key and MCP client changes.
- Validate key rotation by triggering a 401/402/403 from an upstream provider and confirming rotation occurs; exhaust all keys and confirm a `502 upstream_credentials_exhausted` is returned.
- Validate OTel metrics output includes `provider_cache` and `semantic_cache` attributes.
- Validate Bedrock requests with tool names exceeding the provider limit are truncated correctly.
- Validate Opus 4.8 system message handling by sending a request with a system message to an Opus 4.8 endpoint.

## Breaking changes

- [x] Yes
- [ ] No

The deferred-fill user-mode OAuth flow has been removed (maximhq#3839). Any integrations relying on that flow must migrate to the new per-user credential store approach. The `staticHeadersResolver` and `serverOAuthResolver` identifiers have been renamed to `sharedHeadersResolver` and `sharedOAuthResolver` respectively (maximhq#3840); any direct references must be updated.

## Related issues

maximhq#3817, maximhq#3656, maximhq#3702, maximhq#3703, maximhq#3704, maximhq#3705, maximhq#3779, maximhq#3783, maximhq#3823, maximhq#3824, maximhq#3825, maximhq#3430, maximhq#3491, maximhq#3865, maximhq#3816, maximhq#3868, maximhq#3878, maximhq#3766, maximhq#3829, maximhq#3810, maximhq#3837, maximhq#3843, maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745, maximhq#3862, maximhq#3880, maximhq#3838, maximhq#3881, maximhq#3853, maximhq#3855, maximhq#3841, maximhq#3859, maximhq#3849, maximhq#3826, maximhq#3856, maximhq#3840, maximhq#3794, maximhq#3839, maximhq#3782, maximhq#3724, maximhq#3814, maximhq#3836, maximhq#3869, maximhq#3886

## Security considerations

- MCP per-user credentials are stored via the new `MCPCredentialStore` abstraction; ensure the backing store is appropriately access-controlled and that credential values are encrypted at rest.
- The direct API key header feature passes provider secrets via HTTP headers; ensure TLS is enforced on all ingress paths and that headers are not logged in plaintext.
- User-mode flows are now gated on `caller user_id` and temp token minting is skipped where appropriate, reducing the surface for privilege escalation.
- TLS configuration for MCP HTTP/SSE connections supports `insecureSkipVerify`; this should only be enabled in controlled environments.

## Checklist

- [x] I read `docs/contributing/README.md` and followed the guidelines
- [x] I added/updated tests where appropriate
- [x] I updated documentation where needed
- [x] I verified builds succeed (Go and UI)
- [x] I verified the CI pipeline passes locally if applicable
akhsaul pushed a commit to akhsaul/bifrost that referenced this pull request Aug 27, 2026
## ✨ Features

- **Direct API Key Header** - Pass a provider API key directly via
request header (maximhq#3817)
- **MCP Per-User Authentication** - New per-user header auth type with
credential storage
  and lazy-auth submission flow (maximhq#3703, maximhq#3704, maximhq#3705)
- **MCP TLS Configuration** - Configurable TLS (insecureSkipVerify,
caCertPem) for HTTP/SSE
  MCP client connections (maximhq#3779, maximhq#3783)
- **MCP Sessions Management** - Filter, search, and pagination on the
MCP sessions list API
  and table, plus a can_reauth identity gate (maximhq#3823, maximhq#3824, maximhq#3825)
- **Tool Call Execution UI** - Inline tool-call execution, stop
streaming, bulk
  execute/submit, and a redesigned tool-call UI (maximhq#3837, maximhq#3843)
- **Dimension Rankings Dashboard** - New dashboard tabs for team,
customer, BU, and user
  rankings, backed by a GetDimensionRankings API (maximhq#3766)
- **Model Pricing Attributes** - additional_attributes on model pricing
rows with management
  API and UI editor (maximhq#3829)
- **Prompt Cache Retention** - Prompt cache retention parameter on
responses requests
  (maximhq#3810)
- **Opus 4.8 Support** - System message handling and compatibility for
Opus 4.8 (maximhq#3878,
  maximhq#3868)
  - **Key Rotation** - Rotate keys on 401/402/403 and return 502
upstream_credentials_exhausted when all keys are permanently dead
(maximhq#3491)
- **OTel Metrics** - OTel spec compatible metrics plus provider and
semantic cache
  attributes in metrics export (maximhq#3865, maximhq#3816)
- **Sheet Navigation** - Prev/next keyboard navigation and URL state
across virtual key, MCP
  client, and routing rule sheets (maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745)
  - **Go 1.26.3** - Upgraded toolchain to Go 1.26.3 (maximhq#3782)

  ## 🐞 Fixed

- **Bedrock Tool Names** - Truncate Bedrock function/tool names to the
provider length limit
- **Bedrock Guardrails** - Set guardrail config in Bedrock request built
from responses
  (maximhq#3862)
- **Anthropic Tool Use** - Default Anthropic tool_use input to {} when
arguments are absent
  (maximhq#3880)
  - **Responses Streaming** - Fixed responses stream events (maximhq#3838)
- **Compat Flow** - Fixed missing parameter parsing on the compat flow
(maximhq#3881)
- **Passthrough API Version** - Set a default API version in passthrough
requests as a
  fallback (maximhq#3853)
- **Virtual Key Updates** - Avoid overriding optional fields during
virtual key update
  (maximhq#3855)
- **User-Mode Flows** - Gate user-mode flows on caller user_id, skip
temp token mint, and
  unify flow/credential kind filtering for pending flows (maximhq#3841, maximhq#3859)
- **Partial Tool Calls** - Handle partial tool call execution failures
and return successful
  results (maximhq#3849)
- **URL Query Escaping** - Support escaped characters in URL query
parameters (maximhq#3826)
- **MCP Auth Errors** - Inline banner and retry support for MCP
auth-required errors (maximhq#3856)
- **JSON Editor Height** - Cap JSON editor max height at 400px in
message views (maximhq#3842)
occcat pushed a commit to occcat/bifrost that referenced this pull request Sep 2, 2026
…port (maximhq#3816)

## Summary

Adds provider-side prompt cache token metrics (`cache_read`, `cache_write`, `cache_write_5m`, `cache_write_1h`) to both the Prometheus and OTEL telemetry plugins. These are distinct from the existing `cache_hits_total` counter, which tracks Bifrost's own semantic-cache hits. Also fixes the OTEL plugin's `PostLLMHook` (previously a no-op) to correctly emit cache-hit metrics for semantic-cache responses that short-circuit before any provider span is created.

## Changes

- **Prometheus plugin**: Added four new `CounterVec` metrics — `bifrost_cache_read_input_tokens_total`, `bifrost_cache_write_input_tokens_total`, `bifrost_cache_write_input_tokens_5m_total`, and `bifrost_cache_write_input_tokens_1h_total`. A new `extractProviderCacheTokens` helper reads these values from `PromptTokensDetails` (Chat/TextCompletion) or `InputTokensDetails` (Responses API) and emits them in `PostLLMHook`.
- **OTEL plugin**: Implemented the same four provider cache token counters and their `Record*` methods on `MetricsExporter`. The previously no-op `PostLLMHook` now emits the semantic cache-hit metric using a new `buildContextAttrs` helper that sources dimensions from request context rather than a span (since cache hits have no provider span). Provider cache token counts are recorded in `recordMetricsFromTrace` from span attributes, covering both the unified read/write keys and the Anthropic-specific 5m/1h TTL breakdown keys.
- **Schema mux**: Propagated `CachedWriteTokenDetails` through both `ToResponsesResponseUsage` and `ToBifrostLLMUsage` conversion functions so the TTL breakdown is preserved across API format conversions.
- The 5m/1h counters are explicitly documented as subsets of the write total and should not be summed with it.

## Type of change

- [ ] Bug fix
- [x] Feature
- [ ] Refactor
- [ ] Documentation
- [ ] Chore/CI

## Affected areas

- [x] Core (Go)
- [ ] Transports (HTTP)
- [ ] Providers/Integrations
- [x] Plugins
- [ ] UI (React)
- [ ] Docs

## How to test

```sh
go test ./...
```

- Configure a provider that supports prompt caching (e.g. Anthropic, OpenAI).
- Send requests that exercise prompt cache reads and writes.
- Verify the following metrics are emitted with non-zero values:
  - `bifrost_cache_read_input_tokens_total`
  - `bifrost_cache_write_input_tokens_total`
  - `bifrost_cache_write_input_tokens_5m_total` (Anthropic only)
  - `bifrost_cache_write_input_tokens_1h_total` (Anthropic only)
- Trigger a semantic cache hit and verify `bifrost_cache_hits_total` increments exactly once (not double-counted).

## Breaking changes

- [ ] Yes
- [x] No

## Related issues

## Security considerations

None.

## Checklist

- [ ] I read `docs/contributing/README.md` and followed the guidelines
- [ ] I added/updated tests where appropriate
- [ ] I updated documentation where needed
- [ ] I verified builds succeed (Go and UI)
- [ ] I verified the CI pipeline passes locally if applicable
occcat pushed a commit to occcat/bifrost that referenced this pull request Sep 2, 2026
## Summary

This PR releases **core v1.5.14**, **framework v1.3.14**, **transports v1.5.6**, and bumps all dependent plugins to their respective `.14` patch versions. It delivers a broad set of new capabilities across MCP authentication, key rotation, OTel metrics, Bedrock/Anthropic compatibility, and UI improvements, alongside a number of targeted bug fixes and refactors.

## Changes

- **Direct API Key Header** — Providers can now receive an API key passed directly via a request header (maximhq#3817)
- **MCP Per-User Auth** — Introduced `MCPCredentialStore` abstraction, per-user MCP credential reconciliation, and a new per-user header auth type with lazy-auth submission flow (maximhq#3656, maximhq#3702, maximhq#3703, maximhq#3704, maximhq#3705)
- **MCP TLS Configuration** — Added configurable TLS (`insecureSkipVerify`, `caCertPem`) for HTTP/SSE MCP client connections (maximhq#3779, maximhq#3783)
- **MCP Sessions Management** — Filter, search, and pagination on the MCP sessions list API and table, plus a `can_reauth` identity gate (maximhq#3823, maximhq#3824, maximhq#3825)
- **Key Rotation** — Keys now rotate on 401/402/403 responses; returns `502 upstream_credentials_exhausted` when all keys are permanently exhausted. Added `triggered_rotation` to `KeyAttemptRecord` and tightened `bifrost_key_rotation_events_total` semantics (maximhq#3430, maximhq#3491)
- **OTel Metrics** — Added OTel spec-compatible metrics (backward compatible) with provider cache and semantic cache attributes in metrics export (maximhq#3865, maximhq#3816)
- **Opus 4.8 Support** — System message handling and general compatibility for Opus 4.8 (maximhq#3868, maximhq#3878)
- **Dimension Rankings** — New `GetDimensionRankings` API and dashboard tabs for team, customer, BU, and user rankings (maximhq#3766)
- **Model Pricing Attributes** — `additional_attributes` field on model pricing rows with management API and UI editor (maximhq#3829)
- **Prompt Cache Retention** — Added prompt cache retention parameter on responses requests (maximhq#3810)
- **Tool Call Execution UI** — Inline tool-call execution, stop streaming, bulk execute/submit, and a redesigned tool-call UI (maximhq#3837, maximhq#3843)
- **Sheet Navigation** — Prev/next keyboard navigation and URL state across virtual key, MCP client, and routing rule sheets (maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745)
- **Bedrock Tool Name Truncation** — Truncate Bedrock function/tool names to the provider length limit
- **Bedrock Guardrails** — Set guardrail config in Bedrock requests built from responses (maximhq#3862)
- **Anthropic Tool Use** — Default `tool_use` input to `{}` when arguments are absent (maximhq#3880)
- **Responses Streaming** — Fixed responses stream events (maximhq#3838)
- **Compat Flow** — Fixed missing parameter parsing on the compat flow (maximhq#3881)
- **Passthrough API Version** — Set a default API version in passthrough requests as a fallback (maximhq#3853)
- **Virtual Key Updates** — Avoid overriding optional fields during virtual key update (maximhq#3855)
- **User-Mode Flows** — Gate user-mode flows on caller `user_id`, skip temp token mint, and unify flow/credential kind filtering for pending flows (maximhq#3841, maximhq#3859)
- **Partial Tool Calls** — Handle partial tool call execution failures and return successful results (maximhq#3849)
- **URL Query Escaping** — Support escaped characters in URL query parameters (maximhq#3826)
- **MCP Auth Errors** — Inline banner and retry support for MCP auth-required errors (maximhq#3856)
- **Renamed Resolvers** — `staticHeadersResolver`/`serverOAuthResolver` renamed to `sharedHeadersResolver`/`sharedOAuthResolver` (maximhq#3840)
- **Starlark Nested Tool Calls** — Exposed `RunWithPluginPipeline` on `ClientManager` and routed Starlark nested tool calls through the canonical plugin gate (maximhq#3794)
- **Deferred-Fill OAuth Removed** — Removed deferred-fill user-mode OAuth flow support (maximhq#3839)
- **Go 1.26.3** — Upgraded toolchain to Go 1.26.3 (maximhq#3782)

## Type of change

- [x] Bug fix
- [x] Feature
- [x] Refactor
- [ ] Documentation
- [x] Chore/CI

## Affected areas

- [x] Core (Go)
- [x] Transports (HTTP)
- [x] Providers/Integrations
- [x] Plugins
- [x] UI (React)
- [ ] Docs

## How to test

```sh
# Core/Transports
go version  # should report go1.26.3
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build
```

- Validate MCP per-user auth by configuring a per-user header auth type and confirming credentials are stored and reconciled on virtual key and MCP client changes.
- Validate key rotation by triggering a 401/402/403 from an upstream provider and confirming rotation occurs; exhaust all keys and confirm a `502 upstream_credentials_exhausted` is returned.
- Validate OTel metrics output includes `provider_cache` and `semantic_cache` attributes.
- Validate Bedrock requests with tool names exceeding the provider limit are truncated correctly.
- Validate Opus 4.8 system message handling by sending a request with a system message to an Opus 4.8 endpoint.

## Breaking changes

- [x] Yes
- [ ] No

The deferred-fill user-mode OAuth flow has been removed (maximhq#3839). Any integrations relying on that flow must migrate to the new per-user credential store approach. The `staticHeadersResolver` and `serverOAuthResolver` identifiers have been renamed to `sharedHeadersResolver` and `sharedOAuthResolver` respectively (maximhq#3840); any direct references must be updated.

## Related issues

maximhq#3817, maximhq#3656, maximhq#3702, maximhq#3703, maximhq#3704, maximhq#3705, maximhq#3779, maximhq#3783, maximhq#3823, maximhq#3824, maximhq#3825, maximhq#3430, maximhq#3491, maximhq#3865, maximhq#3816, maximhq#3868, maximhq#3878, maximhq#3766, maximhq#3829, maximhq#3810, maximhq#3837, maximhq#3843, maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745, maximhq#3862, maximhq#3880, maximhq#3838, maximhq#3881, maximhq#3853, maximhq#3855, maximhq#3841, maximhq#3859, maximhq#3849, maximhq#3826, maximhq#3856, maximhq#3840, maximhq#3794, maximhq#3839, maximhq#3782, maximhq#3724, maximhq#3814, maximhq#3836, maximhq#3869, maximhq#3886

## Security considerations

- MCP per-user credentials are stored via the new `MCPCredentialStore` abstraction; ensure the backing store is appropriately access-controlled and that credential values are encrypted at rest.
- The direct API key header feature passes provider secrets via HTTP headers; ensure TLS is enforced on all ingress paths and that headers are not logged in plaintext.
- User-mode flows are now gated on `caller user_id` and temp token minting is skipped where appropriate, reducing the surface for privilege escalation.
- TLS configuration for MCP HTTP/SSE connections supports `insecureSkipVerify`; this should only be enabled in controlled environments.

## Checklist

- [x] I read `docs/contributing/README.md` and followed the guidelines
- [x] I added/updated tests where appropriate
- [x] I updated documentation where needed
- [x] I verified builds succeed (Go and UI)
- [x] I verified the CI pipeline passes locally if applicable
occcat pushed a commit to occcat/bifrost that referenced this pull request Sep 2, 2026
## ✨ Features

- **Direct API Key Header** - Pass a provider API key directly via
request header (maximhq#3817)
- **MCP Per-User Authentication** - New per-user header auth type with
credential storage
  and lazy-auth submission flow (maximhq#3703, maximhq#3704, maximhq#3705)
- **MCP TLS Configuration** - Configurable TLS (insecureSkipVerify,
caCertPem) for HTTP/SSE
  MCP client connections (maximhq#3779, maximhq#3783)
- **MCP Sessions Management** - Filter, search, and pagination on the
MCP sessions list API
  and table, plus a can_reauth identity gate (maximhq#3823, maximhq#3824, maximhq#3825)
- **Tool Call Execution UI** - Inline tool-call execution, stop
streaming, bulk
  execute/submit, and a redesigned tool-call UI (maximhq#3837, maximhq#3843)
- **Dimension Rankings Dashboard** - New dashboard tabs for team,
customer, BU, and user
  rankings, backed by a GetDimensionRankings API (maximhq#3766)
- **Model Pricing Attributes** - additional_attributes on model pricing
rows with management
  API and UI editor (maximhq#3829)
- **Prompt Cache Retention** - Prompt cache retention parameter on
responses requests
  (maximhq#3810)
- **Opus 4.8 Support** - System message handling and compatibility for
Opus 4.8 (maximhq#3878,
  maximhq#3868)
  - **Key Rotation** - Rotate keys on 401/402/403 and return 502
upstream_credentials_exhausted when all keys are permanently dead
(maximhq#3491)
- **OTel Metrics** - OTel spec compatible metrics plus provider and
semantic cache
  attributes in metrics export (maximhq#3865, maximhq#3816)
- **Sheet Navigation** - Prev/next keyboard navigation and URL state
across virtual key, MCP
  client, and routing rule sheets (maximhq#3739, maximhq#3740, maximhq#3744, maximhq#3745)
  - **Go 1.26.3** - Upgraded toolchain to Go 1.26.3 (maximhq#3782)

  ## 🐞 Fixed

- **Bedrock Tool Names** - Truncate Bedrock function/tool names to the
provider length limit
- **Bedrock Guardrails** - Set guardrail config in Bedrock request built
from responses
  (maximhq#3862)
- **Anthropic Tool Use** - Default Anthropic tool_use input to {} when
arguments are absent
  (maximhq#3880)
  - **Responses Streaming** - Fixed responses stream events (maximhq#3838)
- **Compat Flow** - Fixed missing parameter parsing on the compat flow
(maximhq#3881)
- **Passthrough API Version** - Set a default API version in passthrough
requests as a
  fallback (maximhq#3853)
- **Virtual Key Updates** - Avoid overriding optional fields during
virtual key update
  (maximhq#3855)
- **User-Mode Flows** - Gate user-mode flows on caller user_id, skip
temp token mint, and
  unify flow/credential kind filtering for pending flows (maximhq#3841, maximhq#3859)
- **Partial Tool Calls** - Handle partial tool call execution failures
and return successful
  results (maximhq#3849)
- **URL Query Escaping** - Support escaped characters in URL query
parameters (maximhq#3826)
- **MCP Auth Errors** - Inline banner and retry support for MCP
auth-required errors (maximhq#3856)
- **JSON Editor Height** - Cap JSON editor max height at 400px in
message views (maximhq#3842)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants