Stravia v0.4.0

Added

• Added standalone antigravity and claude-code Vendor Plugins for account OAuth, model discovery, inference, and allowance monitoring. Antigravity uses Google's hosted callback with authorization-code entry; Claude Code supports Claude Pro/Max subscriptions. Third-party OAuth/subscription use may violate Google's or Anthropic's terms and lead to account restrictions, suspension, or termination. Existing removed anthropic/claude-code connections are not migrated: create a new claude-code connection and rebind its Routes.
• Added the standalone opencode-free Vendor Plugin for OpenCode Zen free-model discovery and inference (-free models and big-pickle). API keys are optional; anonymous access is subject to upstream IP limits. Free-tier models and compatibility requirements may change, and third-party access may violate upstream terms or result in access restrictions. The existing paid opencode profile remains separate.
• Added per-model-service allowance guards. Exhausted guarded account items persistently pause the service's Targets across Routes without changing administrator enable switches; fresh successful reads or removing guards can restore routing. Fully paused candidates return a native quota error (HTTP 429, without Retry-After).
• Custom Chat Completions profiles can select reasoning_content, reasoning, or a custom reasoning field for response decoding and history replay. The independent opt-in ensure_reasoning_field setting fills missing/null history fields without replacing real reasoning; these settings do not enable thinking or rewrite saved history.
• Credential Protection supports custom exact-text and regular-expression rules, filtering, and match testing. Deleting a rule leaves its existing mappings restorable until expiry.
• Desktop and Server startup screens show real migration stages and progress. Server displays preparation before business APIs and health/readiness probes become available.
• Vendor Plugins can embed SVG brand marks; the seven standalone plugins include them, while base profiles use their own brand identities.
• Added task test:all for the complete local Windows test matrix, including browser/desktop smoke tests, isolated PostgreSQL, incremental-build checks, and cleanup. Failures or exceeding five minutes fail the command; initial cold builds are outside that time target.

Changed

• Breaking — RPM: API-key concurrency_limit is replaced by nullable rpm_limit, enforcing a sliding 60-second root-request limit across proxy, compaction, and MCP execution. Migration 0009 clears old limits: all existing keys are unlimited until new RPM limits are configured. Upstream limits belong only to Provider/upstream-model destinations and apply across Routes, retries, and hidden turns. Shared pools are removed; migration 0014 deletes pools/bindings without copying their limits, so former members become unlimited. The settings API rejects pools and rpm_pool_id. Runtime windows reset on restart and do not coordinate across instances.
• Breaking — Targets: Every Route Target, including external Web Search, requires a nonblank upstream model and its Provider Model capability. Migration 0012 deletes legacy model-less Targets and admission destinations while retaining Routes; rebind affected Routes. Vendor SDK Rust channel descriptors no longer expose the search-model requirement flag; the WIT ABI is unchanged.
• Breaking — Model specifications/pricing: Specifications retain only limit.context and a reasoning_efforts list, removing feature flags, separate input/output limits, and toggle/budget specification fields. Native request capabilities and explicit Target reasoning controls remain supported. Prices retain only input, output, cache-read, and cache-write rates; migration 0013 permanently removes stored reasoning/audio rates while preserving remaining decimal prices and usage records. Client configurations no longer export model output-token limits.
• Breaking — Observation API: Removed /interactions/{id}/summary and redundant lifecycle/debug/content-delta events. Usage settles in target_attempt_finished and delivery in run_finished. Global event notifications carry change metadata; durable timeline details must be fetched on demand, and selected live content uses a separate subscription. Root changes use /api/v1/observations/interactions/changes with removals and snapshot resets. See the observation contract.
• Breaking — Usage semantics: Management input_tokens consistently means upstream-reported total input; cache is a separate breakdown, not added again. Historical reads use the new semantics without rewriting stored values. Token speed now includes first-token waiting; Run duration/TPS use client receipt through delivery, including retries and platform tools, while Provider throughput is weighted over full attempts.
• Generation history and ordinary observations use shared binary compression and deduplicated Canonical Items. Startup converts supported legacy data; existing SQLite files are not automatically vacuumed. Debug manifests move to the owning instance's diagnostics/observation-debug/ directory and are unavailable to database-only replicas.
• Request History has bounded live updates, earlier-event loading with scroll preservation, automatic following at the bottom, and collapsed diagnostic Run summaries. Model screens show compact tables/lists, modality icons, request-destination summaries, and in-place specification/RPM editing with revision protection. Allowances use compact expandable rows, a remembered Remaining/Used switch, and visible pause guards.
• OAuth model services offer Reauthorize without changing saved connection settings; invalid credentials pause upstream allowance reads and mark retained values stale. Codex balances use credits rather than USD, and placeholder reset dates no longer appear or distort balance trends.
• Confirmed native thinking-summary paths request summaries by default without changing reasoning intensity. Targets without configured thinking levels remain eligible and omit effort parameters. Antigravity discovery groups registered effort variants into families; Claude Code discovery reads native capabilities/context from /v1/models.
• Devin drops unsupported optional request controls rather than rejecting them; callers must not rely on tool-choice, sampling, or structured-output constraints being honored there. Base/OpenCode requests use stable conversation affinity identifiers for upstream caching.
• Vendor SDK uses WASI 0.2.12; the host accepts stable 0.2.x patch versions of the existing restricted interfaces. The stravia:vendor@0.4.0 contract is unchanged, and filesystem/raw-socket/WASI HTTP imports remain forbidden. Plugin loading reuses immutable compilations without sharing guest state.
• Default Gateway, Provider Catalog, and S3 HTTP clients connect directly instead of inheriting ambient proxies; explicitly configured Provider proxies remain supported. Rust workspace dependency/features and isolated test artifacts improve incremental build reuse.

Fixed

• Fixed Docker source builds missing required inputs: declared Bun patches are copied before locked WebUI installation, and original brand SVGs are available when compiling embedded Vendor Plugin marks.
• Fixed thinking and tool-history replay across Chat Completions, Responses, Anthropic, Gemini, Command Code, and Devin, including failover, protected payload boundaries, late signatures, empty/null reasoning fields, and previous_response_id continuation. Genuine native signatures remain preserved; official Gemini migration handling does not apply to unverified/custom endpoints.
• Fixed immediate client-tool continuation attribution and duplicate historical user/tool observations. Confirmed delivery settles before later admission and is no longer mislabeled as interrupted by late finalization; old observations are not rewritten.
• Failed Responses streams deliver one response.failed snapshot with partial output and confirmed usage. Chat responses claiming tool_calls without actual calls now fail instead of returning empty success. Failure statistics count final client-request failures once, excluding recovered retries, cancellations, and active requests; Debug Bundles retain confirmed late usage.
• Fixed Gemini/Antigravity streaming metadata, generated-media identities, boolean tool schemas, and tool-result shapes. Cross-protocol image detail hints no longer reject otherwise valid requests; text-only Chat requests use the standard string carrier, and native Anthropic tool flags/error results are preserved.
• Fixed Claude Code OAuth state compatibility, CLI-format requests, cache breakpoints, model-specific thinking/sampling controls, summary formats, and explicit allowance-exhaustion failover. The plugin owns cache-breakpoint placement; client-selected breakpoint positions and TTLs are not honored. Codex discovery uses an updated client version, and streamed inference tolerates missing SSE Content-Type.
• Requests whose upstream Retry-After exceeds the remaining request window try an eligible backup or return the original error instead of waiting for a 504; upstream waits are not shortened. Request-specific errors no longer poison shared Target health. Vendor transport diagnostics preserve redacted underlying causes and real WebSocket Close frames.
• Fixed large-database startup migration and SQLite retention scans, writer contention, and long-history discovery costs. Line-ending-only migration checksum differences are accepted without rewriting migration history; actual SQL differences remain errors. Incremental builds now re-embed newly added migrations.
• Fixed stale allowance reads overwriting saved guards, unsaved model drafts being lost during navigation/asynchronous operations, absent-modality text defaults, whitespace-only output previews, per-turn output separators, and table/config-preview layout issues.

Upgrade notes

• Stop the instance and back up the complete data directory plus any external PostgreSQL database before upgrading. Include imported plugin artifacts and Debug files. Storage conversions and migrations remove retired configuration; rollback requires restoring that backup, not opening the upgraded schema with an older binary.
• Before reopening traffic, configure API-key RPM limits, destination limits for former shared-pool members, and real Provider Model bindings for Routes whose model-less Targets were deleted. Removed model prices cannot be recovered without the backup. See configuration and migration.
• Update Stravia and re-import affected standalone plugin release assets to receive OAuth, codec, brand-mark, and provider-wire fixes. Compatible installed plugins do not require rebuilding solely for WASI patch-version support. Sync Antigravity/Claude Code/Codex models afterward and refresh allowances; Antigravity's old per-variant models and Route bindings are not automatically removed or rebound.

---

Full Changelog: v0.3.1...v0.4.0