Spillway 0.6.0

What's new

• A brake for runaway agents (rule 5). A key without a daily or monthly limit of its own that
  suddenly spends far more in an hour than in any hour of the two weeks before (by default three
  times, and at least $20) is stopped. Its cloud requests go to the local model, or are refused if
  the key has no local fallback, until an admin clicks Let back on the Keys page. The stop shows
  under Needs attention, in a Slack, Teams or email notice, and in Claude Code's status line
  ("stopped: unusual spending"). Keys with limits of their own are never stopped: for them an admin
  already chose how much is too much.
• Ask for more. Someone who uses up the day's limit sees where to ask for more: in Claude
  Code's status line, in the refusal their app shows, and as Ask for more next to their key on
  the Keys page. An admin gets a message, sees the request at the top of Keys and approves or
  declines it with one click. What they approve counts for that day only.
• Replace a leaked key. A key pasted into a public channel no longer means setting up a new
  one by hand. Replace key gives it a new value and the old one stops working at once; limits,
  allowed models and history stay. People can open their own keys on the Keys page to replace or
  revoke them.
• Keys with an end date. Works until in a key's settings, for a contractor, an intern or a
  trial. The key works through that day, then its apps are told it "has passed its end date"
  instead of "invalid key". Three days before the end, a key that is still in use says so in
  Claude Code's status line, under Needs attention and in one notice.
• A monthly report for the books. Download report on Budgets & rules gives a spreadsheet
  of any of the last twelve months: one row per key and model with the team, the person, requests,
  tokens, cost and money saved. It opens in Excel with names in any language intact. People get
  their own keys only.

Upgrading from 0.5.0

Pull the new image and restart. On its first start Spillway runs three migrations (0010–0012) that
add a few columns and one small table; they take no noticeable time, even on a large log.

Rule 5 is on after the upgrade with the defaults above. At start the gateway reads each key's last
two weeks of spend from the log, so existing keys are compared with their own history. A brand-new
key has no history yet and is stopped once it spends $20 within an hour: if you start agents that
spend more than that from day one, raise the minimum or turn the rule off in Budgets & rules.

Run it

curl -fsSLO https://github.com/Artemy-And/spillway/releases/download/v0.6.0/docker-compose.yml
SPILLWAY_TAG=0.6.0 docker compose up -d

Image ghcr.io/artemy-and/spillway:0.6.0 for linux/amd64 and linux/arm64, digest sha256:7beb598db0e43ede5ef1d9901e4aecdc0b9f060aefbd0e7def36bd7bcbed05bf.

Verify it

The image is signed by this repository's release workflow through Sigstore, with no
long-lived signing key:

cosign verify ghcr.io/artemy-and/spillway:0.6.0 \
  --certificate-identity https://github.com/Artemy-And/spillway/.github/workflows/release.yml@refs/tags/v0.6.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

It also carries an SBOM and build provenance:
docker buildx imagetools inspect ghcr.io/artemy-and/spillway:0.6.0 --format "{{ json .Provenance }}"

Full Changelog: v0.5.0...v0.6.0

Spillway 0.5.0

What's new

• Which apps send requests. Overview has a Requests by app card with each app's share of
  requests and its spend. Spillway tells Claude Code, Codex and n8n apart from what they already
  send, so nothing changes on their side; the rest count as "Other apps". The request log filters
  by app, Keys shows the app of each key's latest request under "Last used", and the Monday summary
  says "Requests by app: Claude Code 50%, Codex 25%, other apps 25%." Requests from before the
  upgrade have no app. Open WebUI counts as "Other apps" unless it forwards user info (#2).
• Where the month is heading. Under the month's spend, Overview says "At the last 7 days' pace,
  about $463 by month end", in amber when that passes the total budget. Needs attention warns
  about a team that is still under its budget but will run out before the month ends: "Marketing
  will run out of its $100 budget around Oct 23 at the last 7 days' pace".
• The same requests on another model. Pick a cloud model with a price under Spend by model,
  and Overview shows about what the period's paid requests would have cost on it, e.g. "About
  $16.95 instead of $174.01". Prompts that were cached count as cached on the other model too, so
  Claude Code traffic is not overstated.
• Who keeps the local models busy. Local answers cost $0, so they never show in Top spenders.
  When the period has local traffic, the card switches to Local models: the five keys with the
  most model time, with requests, tokens and their share of all local time.
• Faster Overview. Overview reads an index instead of the log rows. On a month of logs
  (200,000 requests) it loads in about 0.3 s instead of 1.8 s, so requests wait less behind its
  30-second refresh.

Upgrading from 0.4.0

Pull the new image and restart. On its first start Spillway runs four migrations: the request log
gets an app column and its date index is rebuilt with more columns. On a month of logs (200,000
requests) this takes about 5 seconds, and requests wait until it is done.

Run it

curl -fsSLO https://github.com/Artemy-And/spillway/releases/download/v0.5.0/docker-compose.yml
SPILLWAY_TAG=0.5.0 docker compose up -d

Image ghcr.io/artemy-and/spillway:0.5.0 for linux/amd64 and linux/arm64, digest sha256:61e58c7f7f7755ff47e9c7e0ba802b5633f7767cfc16f876425fdf28aef0951f.

Verify it

The image is signed by this repository's release workflow through Sigstore, with no
long-lived signing key:

cosign verify ghcr.io/artemy-and/spillway:0.5.0 \
  --certificate-identity https://github.com/Artemy-And/spillway/.github/workflows/release.yml@refs/tags/v0.5.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

It also carries an SBOM and build provenance:
docker buildx imagetools inspect ghcr.io/artemy-and/spillway:0.5.0 --format "{{ json .Provenance }}"

Full Changelog: v0.4.0...v0.5.0

Spillway 0.4.0

What's new

• Will the local model work for Claude Code and Codex? Under the local model in Settings,
  Check the model loads it and reports the context it runs with, whether it can call tools and
  how fast it answers. Coding agents send 20–30 thousand tokens a request, while Ollama runs a
  model with 4,096 unless told otherwise and drops the start of a longer prompt without an error,
  so a rerouted agent would lose its instructions. For an Ollama model with a short context, one
  more click has Ollama make a copy of it with 32,768 tokens and switches to it: nothing is
  downloaded, and clients keep the same model name. LM Studio and other OpenAI-compatible servers
  get the tool and speed checks.

• Spending in Claude Code's status line. The Claude Code tab of a new key now gives a
  ~/.claude/settings.json that the terminal and the VS Code extension both read, with a status
  line. After every answer, the bottom line of Claude Code in the terminal shows what the key has
  spent, the team's share of its budget and where the next request goes:

  Spillway · $3.20 of $10.00 today · Engineering at 54% · Claude Sonnet
  Spillway · $10.40 of $10.00 today · Engineering at 55% · → Qwen Coder, local (daily limit reached)
  

• Smaller. A copy button under the client settings in the new-key panel. The "prompt cut"
  alert and the request log point to the model check instead of an environment variable.

Upgrading from 0.3.3

Pull the new image and restart; there is nothing to migrate.

Run it

curl -fsSLO https://github.com/Artemy-And/spillway/releases/download/v0.4.0/docker-compose.yml
SPILLWAY_TAG=0.4.0 docker compose up -d

Image ghcr.io/artemy-and/spillway:0.4.0 for linux/amd64 and linux/arm64, digest sha256:62df72a9005b22e95ed326907bac9e8ff16d5a4f299ab0d1746791e04b6b58d6.

Verify it

The image is signed by this repository's release workflow through Sigstore, with no
long-lived signing key:

cosign verify ghcr.io/artemy-and/spillway:0.4.0 \
  --certificate-identity https://github.com/Artemy-And/spillway/.github/workflows/release.yml@refs/tags/v0.4.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

It also carries an SBOM and build provenance:
docker buildx imagetools inspect ghcr.io/artemy-and/spillway:0.4.0 --format "{{ json .Provenance }}"

Full Changelog: v0.3.3...v0.4.0

Spillway 0.3.3

What's new

Found while running Claude Code through Spillway for a day:

• Provider refusals in plain words. A rate limit, a missing model and an outage at the provider
  no longer all read "Error" in the request log. The list says "Provider limit", "No such model"
  or "Provider down", and the details explain it in the viewer's language before quoting the
  provider. Gemini's errors, which arrive as a JSON array, are unpacked instead of shown raw.
• The question, not the wrapping. The log preview leaves out Claude Code's system-reminder
  blocks, Codex's environment messages and tool results, so it shows what the person asked.
• No silent free models. A request to a cloud model without a price ends with a warning that
  budgets do not count it, instead of only "Within budget".
• Smaller fixes. Gemini models are named gemini-3.8-flash rather than
  models/gemini-3.8-flash. The new-key panel gives Windows PowerShell commands for Claude Code
  and Codex, and sets ANTHROPIC_DEFAULT_HAIKU_MODEL, which Claude Code uses for background
  requests such as session titles. Response times use the viewer's language ("0,9 с").

Upgrading from 0.3.2

Pull the new image and restart; there is nothing to migrate.

Run it

curl -fsSLO https://github.com/Artemy-And/spillway/releases/download/v0.3.3/docker-compose.yml
SPILLWAY_TAG=0.3.3 docker compose up -d

Image ghcr.io/artemy-and/spillway:0.3.3 for linux/amd64 and linux/arm64, digest sha256:62d4907c1c596908527d08a8e2a1ce4401dfd0e3ceb23892bc81368048b6390e.

Verify it

The image is signed by this repository's release workflow through Sigstore, with no
long-lived signing key:

cosign verify ghcr.io/artemy-and/spillway:0.3.3 \
  --certificate-identity https://github.com/Artemy-And/spillway/.github/workflows/release.yml@refs/tags/v0.3.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

It also carries an SBOM and build provenance:
docker buildx imagetools inspect ghcr.io/artemy-and/spillway:0.3.3 --format "{{ json .Provenance }}"

Full Changelog: v0.3.2...v0.3.3

Spillway 0.3.2

What's new

• Coding agents no longer wait on the privacy check. Checking a Claude Code or Codex request for
  passport numbers looked for the word "passport" behind every character of the prompt. On a typical
  240 KB agent turn that took about 600 ms, and the whole gateway waited for it. It now takes about
  15 ms and finds the same numbers.
• Budget limits are checked from the indexes. Every request sums its key's and team's spend; the
  request log indexes now carry the cost, so the sums never read the log rows. With 200,000 requests
  logged this month, a small request takes about 30 ms in the gateway instead of about 100 ms.
• A lighter Overview page. The 14-day chart turned every log row into a date in JavaScript instead
  of grouping them by quarter hour in SQL. The page refreshes every 30 seconds while it is open; with
  175,000 requests in the last week it now takes 0.9 s instead of 2 s.

Upgrading from 0.3.1

Pull the new image and restart. One migration rebuilds two indexes of the request log; that takes
about 0.4 s for 200,000 logged requests.

Run it

curl -fsSLO https://github.com/Artemy-And/spillway/releases/download/v0.3.2/docker-compose.yml
SPILLWAY_TAG=0.3.2 docker compose up -d

Image ghcr.io/artemy-and/spillway:0.3.2 for linux/amd64 and linux/arm64, digest sha256:902102a915563572b4cb2ec2f2cf78e5c18527536212b4e0f72f6b28847f7ec3.

Verify it

The image is signed by this repository's release workflow through Sigstore, with no
long-lived signing key:

cosign verify ghcr.io/artemy-and/spillway:0.3.2 \
  --certificate-identity https://github.com/Artemy-And/spillway/.github/workflows/release.yml@refs/tags/v0.3.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

It also carries an SBOM and build provenance:
docker buildx imagetools inspect ghcr.io/artemy-and/spillway:0.3.2 --format "{{ json .Provenance }}"

Full Changelog: v0.3.1...v0.3.2

Spillway 0.3.1

What's new

• No more stalls on long prompts. Checking a long run of text without spaces (minified code,
  base64 in a tool result) for personal data could take seconds, and the whole gateway waited for
  it. It now takes milliseconds.
• Earlier tool calls are checked for personal data. What a model put into a tool call (a file
  it wrote, a command it ran) goes back to the provider with the rest of the conversation. Those
  arguments are now checked like messages and tool results, so a card number a local model wrote
  into a file during a reroute cannot reach a cloud model later.
• "One tool call at a time" survives translation. parallel_tool_calls: false from OpenAI and
  Responses clients such as Codex reaches Claude as disable_parallel_tool_use, and the other way
  round. Before, the setting was dropped.

Upgrading from 0.3.0

Pull the new image and restart; there is nothing to migrate.

Run it

curl -fsSLO https://github.com/Artemy-And/spillway/releases/download/v0.3.1/docker-compose.yml
SPILLWAY_TAG=0.3.1 docker compose up -d

Image ghcr.io/artemy-and/spillway:0.3.1 for linux/amd64 and linux/arm64, digest sha256:a8c9f96fa3b51e343b2c42b5031f2df7de984c311a891fafdcc8a71942b4424e.

Verify it

The image is signed by this repository's release workflow through Sigstore, with no
long-lived signing key:

cosign verify ghcr.io/artemy-and/spillway:0.3.1 \
  --certificate-identity https://github.com/Artemy-And/spillway/.github/workflows/release.yml@refs/tags/v0.3.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

It also carries an SBOM and build provenance:
docker buildx imagetools inspect ghcr.io/artemy-and/spillway:0.3.1 --format "{{ json .Provenance }}"

Full Changelog: v0.3.0...v0.3.1

Spillway 0.3.0

What's new

• A setup code for the first admin. A fresh install prints a setup link with a one-time code to
  its logs (docker logs spillway), and only that link can create the admin account. Until now
  whoever opened a fresh install first became its admin, so a server reachable from the internet
  could be claimed before its owner got there. Installs that set ADMIN_EMAIL and ADMIN_PASSWORD
  work as before.
• A warning when Ollama cuts prompts. Ollama silently drops the start of a prompt longer than
  its context (4096 tokens unless OLLAMA_CONTEXT_LENGTH is set), so Claude Code or Codex rerouted
  to the local model loses its instructions. Spillway now spots it, says so in the request log and
  shows it under Needs attention with the fix.
• A hardened admin UI and sign-in: CSRF checks on the admin API, a strict Content-Security-Policy,
  no framing by other sites and a 1 MB body limit. Sign-in answers an unknown email as slowly as a
  wrong password, members can no longer change their own email when single sign-on is on, and the
  CSV export neutralises cells a spreadsheet would run as formulas.

Upgrading from 0.2.0

Pull the new image and restart; there is nothing to migrate, and existing admins, sessions and keys
keep working. The setup code only matters for a gateway that has no admin yet.

Run it

curl -fsSLO https://github.com/Artemy-And/spillway/releases/download/v0.3.0/docker-compose.yml
SPILLWAY_TAG=0.3.0 docker compose up -d

Image ghcr.io/artemy-and/spillway:0.3.0 for linux/amd64 and linux/arm64, digest sha256:71ac84e75082dd60cfa91b73cd9f69a1e1203ad3f43d91af430f57ccfc15079d.

Verify it

The image is signed by this repository's release workflow through Sigstore, with no
long-lived signing key:

cosign verify ghcr.io/artemy-and/spillway:0.3.0 \
  --certificate-identity https://github.com/Artemy-And/spillway/.github/workflows/release.yml@refs/tags/v0.3.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

It also carries an SBOM and build provenance:
docker buildx imagetools inspect ghcr.io/artemy-and/spillway:0.3.0 --format "{{ json .Provenance }}"

Full Changelog: v0.2.0...v0.3.0

Spillway 0.2.0

What's new

• Codex works through Spillway. /v1/responses passes Codex and other Responses API clients to
  OpenAI and Azure OpenAI as they are, so Responses-only models such as gpt-5.1-codex work, and
  translates them for Anthropic, Ollama and every other provider, so Codex can fall back to the local
  model like Claude Code does. The dialog of a new key shows the config.toml to paste.
• Document search. /v1/embeddings, /api/embed and /api/embeddings for Open WebUI, n8n and
  RAG code, with the same keys, limits and log.
• Alerts to Slack, Microsoft Teams and email when a team reaches its threshold or budget, a key
  its limit, or a cloud provider starts failing and comes back, plus a summary every Monday.
• Response cache, off by default: the same request from the same key is answered without a
  provider call. It skips prompts with personal data.
• Providers by name: Azure OpenAI, Google Gemini, Mistral, Groq, DeepSeek, xAI and OpenRouter
  fill in their addresses.
• Prices fill in for well-known models, and a cloud model without a price is flagged instead of
  quietly counting as free.
• Time zone: daily limits reset and working hours count on the gateway's clock, not the
  container's UTC.
• Read-only demo mode (DEMO=true) with a made-up company.
• Claude can answer up to 32k tokens when the client sets no limit (it was 4096), and the bundled
  Ollama starts with a 32k context, which coding agents need.

Upgrading from 0.1.0

Pull the new image and restart; the database migrates on start and keeps everything. Cloud models
that were priced at 0/0 now show as having no price, so give them prices on the Models page.

Run it

curl -fsSLO https://github.com/Artemy-And/spillway/releases/download/v0.2.0/docker-compose.yml
SPILLWAY_TAG=0.2.0 docker compose up -d

Image ghcr.io/artemy-and/spillway:0.2.0 for linux/amd64 and linux/arm64, digest sha256:a7c30ecdf25056f2f080c8702a709c245acdf309871cb77982ca71e4998ad6c5.

Verify it

The image is signed by this repository's release workflow through Sigstore, with no
long-lived signing key:

cosign verify ghcr.io/artemy-and/spillway:0.2.0 \
  --certificate-identity https://github.com/Artemy-And/spillway/.github/workflows/release.yml@refs/tags/v0.2.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

It also carries an SBOM and build provenance:
docker buildx imagetools inspect ghcr.io/artemy-and/spillway:0.2.0 --format "{{ json .Provenance }}"

Full Changelog: v0.1.0...v0.2.0

Spillway 0.1.0

Run it

curl -fsSLO https://github.com/Artemy-And/spillway/releases/download/v0.1.0/docker-compose.yml
SPILLWAY_TAG=0.1.0 docker compose up -d

Image ghcr.io/artemy-and/spillway:0.1.0 for linux/amd64 and linux/arm64, digest sha256:47f8cd35f9ff1e72e1aa738e82d8486db8264c68bc6c6c9360108ada0a77bce5.

Verify it

The image is signed by this repository's release workflow through Sigstore, with no
long-lived signing key:

cosign verify ghcr.io/artemy-and/spillway:0.1.0 \
  --certificate-identity https://github.com/Artemy-And/spillway/.github/workflows/release.yml@refs/tags/v0.1.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

It also carries an SBOM and build provenance:
docker buildx imagetools inspect ghcr.io/artemy-and/spillway:0.1.0 --format "{{ json .Provenance }}"

Full Changelog: https://github.com/Artemy-And/spillway/commits/v0.1.0