v3.8.49

All 1383 entries from this cycle are listed below, one line each — descriptions are
trimmed to fit GitHub's 125,000-character release body. Full wording, context and links:
CHANGELOG.md.
Living section — regenerated 2026-07-19 from all 306 cycle commits (bump 2c62333 → tip). Bullets carry the merged PR and its author; direct pushes listed separately. Finalized at the v3.8.49 release.

✨ New Features

• feat: generalize ensureThinkingBudget to all providers +… (#6979) — @rafaumeu

• feat(6922): effort-tier aliases for glm-5.2 & mimo-v2.5 on… (#6987) — @rafaumeu

• feat(providers): curated OpenRouter embeddings catalog + specialty merge… (#6994)

• feat(quota): opt-in auto-ping to keep Codex quota windows warm (#6995)

• feat(providers): add Agnes AI native provider support (#7035) — @HouMinXi

• feat(sse): allow disabling : comment heartbeats via… (#7036) — @xier2012

• feat(perf): add performance.mark/measure to SSE pipeline +… (#7045) — @oyi77

• feat(providers): add Dahl free inference provider (#7062) — @growab

• feat(ci): boot-smoke the packed npm tarball (check:pack-boot,… (#7086)

• feat(ci): hotfix fast-lane + tests-only E2E skip (WS3.1) (#7088)

• feat(ci): continuous release-green — on-push quick gate + 3x/day… (#7089)

• feat(ci): duration-balanced E2E shards via LPT bin-packing (WS4.1) (#7090)

• feat(ci): TypeScript 7 native shadow for typecheck:core (WS4.2,… (#7091)

• feat(release): npm staged publishing + pre-publish boot-smoke (WS1.3) (#7092)

• feat(release): post-publish verifier — clean-container install + boot… (#7109)

• feat(ci): Mergify merge queue + manual-train fallback runbook… (#7112)

• feat(ci): Windows leg for Electron prepare smoke (WS1.5) (#7113)

• feat(ci): Codecov patch coverage (informational) + fix missing… (#7114)

• feat(sidecar): support conditional provider manifest refresh (#7130) — @KooshaPari

• feat(homolog): real-environment E2E homologation suite (npm run… (#7133)

• feat(usage): add Codex reset credit picker (#7154) — @JxnLexn

• feat(ci): Trunk Flaky Tests uploads for vitest + Playwright E2E… (#7175)

• feat(ci): Trunk Flaky Tests upload on the fast-path vitest job… (#7205)

• feat(kiro): register GPT-5.6 Sol/Terra/Luna model family (#7209)

• feat(dashboard): show Codex plan label in provider and quota views (#7210)

• feat(dashboard): add reorder connections by availability button (#7211)

• feat(dashboard): add 180D and 365D usage/cost analytics periods (#7213)

• feat(api): add Vary: Accept-Encoding to token-authenticated /v1*… (#7217)

• feat(api): expose GET /api/usage/model-latency-stats (#7218)

• feat(dashboard): add compression-mode selector to Context & Cache combos… (#7219)

• feat(sse): route GitHub Copilot Claude models through native… (#7223)

• feat(mitm): add Antigravity reasoning-effort overrides (#7228)

• feat: replace free-text model inputs with hidePaid-aware… (#7229)

• feat: editable ComfyUI base-URL field + per-connection… (#7232)

• feat(sse): add optional-enum null-omission idiom for codex… (#7233)

• feat(sse): preserve tools/tool_choice for tool-bearing requests… (#7235)

• feat(api): accept x-goog-api-key header for client-facing auth (#7236)

• feat(sse): add native xAI Grok Imagine video generation provider (#7238)

• feat: add Type filter and easiest-first sort to Free Provider… (#7240)

• feat(cli): add Grok Build CLI tool setup (~/.grok/config.toml) (#7241)

• feat(provider): add Chenzk API OpenAI-compatible gateway (#7246)

• feat(providers): let custom connections opt into prompt-cache capability (#7257)

• feat(db): include xp_audit_log in automatic retention/prune (#7260)

• feat(api): structured X-Routing-Fallback-Reason header for relay… (#7262)

• feat(compression): support RTK TOML schema v1 filters (#7281) — @JxnLexn

• feat: add principal-scoped CCR MCP lifecycle (#7282) — @JxnLexn

• feat(morph): refresh curated models (#7314) — @backryun

• feat(issue-agent): surface RecordedTriageTimeoutError as 504 (#7315) — @KooshaPari

• feat(incident-response): structured incident response templates (#7334) — @KooshaPari

• feat(providers): add xAI OAuth PKCE provider (#7399) — @fenix007

• feat(models): advertise Claude reasoning-effort variants in /v1/models (#7497) — @thepigdestroyer

• feat(kimi): sync Code, Web, and Moonshot providers (#7531) — @backryun

• feat(resilience): guard OmniRoute peer routing loops (#7555) — @isiahw1

• feat: add Mixedbread AI as embeddings provider (#7595)

• feat(providers): add Rev AI speech-to-text provider (#7596)

• feat: add Freepik (Magnific Mystic) image generation provider (#7597)

• feat(sse): add DeepInfra as a video-generation provider (#7598)

• feat(providers): add Felo chat-aggregator provider (#7599)

• feat(sse): add Notion AI Web (Unofficial/Experimental) provider (#7600)

• feat: add FreeTheAi as OpenAI-compatible gateway provider (#7602)

• feat: add Gladia as an async speech-to-text provider (#7603)

• feat: add EdgeTTS audio-tts provider (#7605)

• feat(video): add Novita AI as video-generation provider (#7606)

• feat: add Segmind image+video provider (#7608)

• feat: add Microsoft Designer as image provider (#7609)

• feat: per-model default reasoning_effort + no-think none on… (#7631)

• feat(sse): per-model upstream header-response timeout override (#7632)

• feat(dashboard): in-product guidance for prompt compression engines (#7634)

• feat(usage): add TTFT/E2E-latency/tokens-per-second to model latency… (#7635)

• feat: import providers from CSV/JSON file (#7636)

• feat: confirm before removing a single connection (#7640)

• feat(sse): honor excluded models in no-auth auto-combo candidate… (#7646)

• feat(providers): add g4f.space no-key gateway… (#7647)

• feat: rate-limit queue admission control (maxQueueDepth + 15s… (#7649)

• feat(sse): generalize session affinity TTL to all providers (#7650)

• feat: OpenRouter quota tracking (key/credits + free-window… (#7651)

• feat(sse): quota tracking for AgentRouter, v0 (Vercel), FreeModel… (#7653)

• feat(providers): Speechmatics STT, gTTS, VibeProxy preset (#6659, #6667,… (#7655)

• feat(api): route Google AI Studio Imagen through… (#7656) — @danscMax

• feat(auth): OIDC as optional dashboard admin login gate (password… (#6973) — @mikolaj92

• feat(api): add pagination params to 8 DB modules + recharts… (#7046) — @oyi77

• feat(proxy): operator-level proxy subscriptions (Karing-style) —… (#7299) — @xier2012

• feat(grok-cli): align with official Grok Build client (#7358) — @backryun

• feat(providers): Complete GHE Copilot OAuth provider implementation (#7546) — @hppsc1215

• feat(guardrails): add CredentialMaskerGuardrail for API key/secret… (#7683) — @Securiteru

• feat(perplexity): refresh provider integrations (#7687) — @backryun

• feat(providers): notion-web live model discovery via getAvailableModels (#7696) — @artickc

• feat(providers): add proactive cf_clearance/User-Agent hint to grok-web… (#7713)

• feat: add live gRPC-web quota fetcher for grok-cli (#7714)

• feat(api): add opt-in auto-sync scheduler for free-proxy sources (#7716)

• feat(dashboard): show proxy name in badge, sort saved-proxy picker,… (#7720)

• feat(cli): add auth export command for decrypted provider… (#7724)

• feat(oauth): accept full ChatGPT session JSON for Codex manual import (#7725)

• feat(sse): add nvidia NIM local RPM budget + concurrency cap (#7726)

• feat(gemini-web): emulate OpenAI tool calling via the webTools prompt shim (#7727)

• feat(services): introduce pluggable service-provider contract, migrate… (#7730)

• feat(mitm): root-CA + per-host leaf certs for AgentBridge static… (#7731)

• feat(providers): add hailuo-web (MiniMax web) chat provider (#7734)

• feat: browser login for Grok Build provider (#7735)

• feat(routing): wire interceptFetch tool interception into the chat… (#7736)

• feat(sse): add X-OmniRoute-Decision routing trace header (#7765)

• feat(providers): zai-web live model discovery with local-catalog fallback (#7766)

• feat(api): sync upstream reasoning.supported_efforts into… (#7767)

• feat(dashboard): pin Kimi providers first in category + official… (#7775)

• feat(chaos+ponytail): parallel chaos-mode dispatch + ponytail output … (#7781) — @Moseyuh333

• feat(perf): IC2 — cache provider connections by ID + lazy-decrypt… (#7787) — @oyi77

• feat(quality): gate the free-tier headline so it can never silently… (#7798)

• feat(providers): expose an explicit tier override for any provider… (#7838)

• feat(routing): read-only auto/* candidate transparency + per-API-key… (#7839)

• feat(catalog): map unmapped free tiers, add navy + aihorde, surface… (#7840)

• feat(providers): add OpenRouter speech-to-text (audio transcription)… (#7861) — @Tasogarre

• feat(qwen): add Qwen3.8 Max Preview catalogs [Part 2/3] (#7874) — @backryun

• feat: support Bun bundled SQLite runtime (#7878) — @Arul-

• feat(providers): add 5 free-tier providers (ainative, aion, sealion,… (#7887)

• feat(vnc-session): persistent noVNC browser login for web-cookie providers (#7892) — @Capslockb

• feat(sse): add PromptQL playground provider (unofficial) (#7911) — @artickc

• feat(cline): align ClinePass catalog and request protocol (#7914) — @backryun

• feat: narrow mcp:connect scope + per-key HTTP tool-scope… (#7967)

• feat: provider tab account search + mirrored top pagination (#7968)

• feat: canonical numeric helpers + tier-1 (analytics) migration (#7969)

• feat(sse): add HyperAgent (hyperagent.com) unofficial web provider (#7994) — @artickc

• feat: copilot-m365-web tone-selected model variants (#7997)

• feat(media): Adobe Firefly image + video generation provider (#8006) — @artickc

• feat(routing): add prompt-cache affinity (#8008) — @JxnLexn

• feat(compression): select model-aware tokenizers (#8009) — @JxnLexn

• feat(compression): add Responses tool-output engine (#8010) — @JxnLexn

• feat(dashboard): Kimi sponsor banner, Kimi Coding preset, official… (#8039)

• feat(dashboard): make Codex quota card windows reflect reality (#8054) — @insoln

• feat(compression): teach the model the CCR retrieve protocol on first… (#8063)

• feat(compression): per-model/endpoint compression exclusion filter (#8064)

• feat(providers): add CLOVA Studio, InternLM and Ant Ling API-key… (#8077) — @alvaretto

• feat(codex): support reference image edits (#8122) — @xiaoyaner0201

• feat(providers): add weekly quota tracking for grok-web (#8127) — @apoapostolov

• feat(providers): add Sarvam AI, Writer Palmyra and PLaMo API-key… (#8161) — @alvaretto

• feat: native Fish Audio TTS provider on /v1/audio/speech (#8164)

• feat: zh-CN terminology glossary + consistency gate +… (#8166)

• feat(providers): add Typhoon (Thailand) and Inception Mercury diffusion… (#8170) — @alvaretto

• feat(sse): restrict auto-combo no-auth pool to allowlist… (#8183)

• feat(sre): add tcp-close-analyzer.py for debugging… (#8208) — @hartmark

• feat(settings): configurable model catalog cache TTL (#8219) — @oyi77

• feat(github-models): refresh catalog and compatibility (#8225) — @backryun

• feat(github): refresh Copilot model catalog (#8226) — @backryun

• feat: classify grok-web Cloudflare anti-bot blocks + gated… (#8241)

• feat(providers): weekly quota for xAI OAuth (Grok) (xai-oauth / xao)… (#8471) — @allanvb

• feat(sse): every completion response now carries an… — @chirag127

• feat(ws): the live-dashboard WebSocket server now auto-starts… — @ianriizky

• feat(sse): configurable per-model upstream… (#6354)

• feat(dashboard): Replace free-text model inputs in the Routing (web… (#6540)

• feat(compression): new omniglyph engine (context-as-image) — renders… (#6556 #6661)

• feat(sse): rate-limit request queue admission control —… — @chirag127

• feat(sandbox): the skill sandbox gained a container-provider… — @KooshaPari

• feat(oauth): accept the full ChatGPT session JSON (not… (#6636)

• feat(sse): add 5 no-key g4f.space gateway providers —… — @chirag127

• feat(sse): add DeepInfra as a video-generation provider… (#6653)

• feat(providers): add Freepik (Magnific Mystic) API-key… (#6654)

• feat(providers): add Rev AI speech-to-text provider… (#6655)

• feat(providers): add Segmind as an image + video generation provider… (#6656)

• feat(providers): add Gladia as an async speech-to-text… (#6657)

• feat(video): add Novita AI as a video-generation… (#6658)

• feat(providers): add Speechmatics as an STT provider — async batch… (#6659)

• feat(providers): add Mixedbread AI as an embeddings… (#6660)

• feat(providers): add Felo (felo.ai) as a free, no-signup, no-API-key… (#6666)

• feat(providers): add gTTS (Google Translate TTS) as a free, no-signup… (#6667)

• feat(sse): add EdgeTTS (Microsoft Edge "Read Aloud") as a free,… (#6668)

• feat(providers): add FreeTheAi as an OpenAI-compatible… (#6670)

• feat(sse): add Microsoft Designer as an unofficial… (#6672)

• feat(providers): add Hailuo Web (hailuo-web) — a free, _token-based… (#6673)

• feat(cli): new omniroute auth export command dumps DECRYPTED… (#6683)

• feat(mitm): the AgentBridge static MITM server (server.cjs) can… (#6684)

• fix(sse): skip thinkingConfig for Gemma models on the… — @chy1211

• feat(xai): route xAI clients to Grok's native /v1/responses… — @ryanngit

• feat(models): add a Settings → AI "Model Overrides" UI plus… — @xz-dev

• feat(api): add Vary: Accept-Encoding to token-authenticated… — @chirag127

• feat(sse): add Notion AI Web (Unofficial/Experimental)… (#6758)

• feat(dashboard): add per-routing-combo compression-mode override to the… (#6760)

• feat(resilience): operator-configurable account rotation policy — a new… — @artickc

• feat(sse): preserve tools/tool_choice for tool-bearing… — @chirag127

• chore(cursor): add Grok 4.5 effort/fast model IDs: (#6774 ). — @andrewmunsell

• feat(codex): Codex provider model discovery now fetches the live… — @JxnLexn

• feat(cursor): register the Opus 4.8, Fable 5, and Sonnet 5 model… — @andrewmunsell

• Changelog fragments (changelog.d/): PRs now add their changelog entry as a new fragment…

• feat(proxy): add a latency-optimized proxy rotation strategy that… — @iamraydoan

• feat(db): include xp_audit_log in the automatic… (#6801)

• feat(fusion): the fusion judge may now draw on its own knowledge and… — @chirag127

• feat(dashboard): search box on the Playground's raw model <select> —… (#6811)

• feat(usage): Antigravity/agy quota widget now surfaces the… (#4017 #6818)

• feat(codex): Codex CLI compatibility shim — the Responses API… (#3697 #6820)

• Z.ai Web (free web-session provider): new zai-web web-cookie provider drives the free… (#6823)

• feat(dashboard): import multiple, possibly different… (#6836)

• feat(compression): update the vendored GCF codec behind the… (#6837)

• feat(sse): OpenRouter quota tracking — a dedicated fetcher polls… (#6842)

• feat(sse): live gRPC-web quota fetcher for Grok Build (grok-cli)… (#6844)

• feat(sse): add dual-window quota tracking for the… (#6845)

• feat(sse): add a static local RPM budget (default… (#6846)

• feat(sse): add quota tracking for the agentrouter… (#6850)

• feat(providers): Add GPT-5.6 support across OpenAI API, Codex, and… (#6862) — @backryun

• chore(providers): Align emitted Claude Code identity headers, bridge… (#6862) — @backryun

• feat(api): add a structured X-Routing-Fallback-Reason… (#6872)

• feat(api): new GET /api/usage/model-latency-stats management… (#6873)

• feat(providers): add a vibeproxy-openai provider-node preset to `POST…

• feat(usage): add… (#6875)

• feat(sse): per-model default reasoning_effort… (#6879)

• feat(providers): let a custom/openai-compatible connection opt into… — @andrea-kingautomation

• feat(dashboard): add a Type filter (No Signup / OAuth Login / API Key)… (#6915)

• feat(providers): expose an editable base-URL field on the ComfyUI… (#6928)

• feat(providers): refresh the curated OpenRouter embeddings catalog… (#6976)

• feat(quota): Add opt-in auto-ping to keep Codex quota windows warm —… (#6977)

• feat(oauth): Add a one-click browser (PKCE) login for Grok Build… (#7013)

• feat(sse): Add optional-enum null-omission idiom for… (#7023)

• feat(auth): accept the x-goog-api-key header for client-facing… — @QRcode1337

• feat(sse): add a local dual-window (5h + 7d,…

• feat(api): opt-in scheduled auto-sync for free-proxy sources… — @chirag127

• feat(kiro): register the GPT-5.6 Sol/Terra/Luna model family (272k… — @SemonCat

• feat(dashboard): show the Codex subscription plan label in provider… — @CarmeloCampos

• feat(dashboard): add a "Reorder" button to provider connections that… — @fzrilsh

• feat(dashboard): add 180D and 365D periods to the Cost Explorer range… (#7213)

• feat(sse): GitHub Copilot Claude models now route through… — @yidecode

• feat(mitm): Antigravity MITM model mappings now support an optional… — @trfi

• feat(sse): add native xAI Grok Imagine video generation provider —… — @anndev-69

• feat(cli): add Grok Build CLI tool setup — writes a… — @rixzkiye

• feat(provider): add Chenzk API OpenAI-compatible gateway. (thanks… — @CahyokPutraDev99

• feat(dashboard): add a per-operator "hide this quota row" toggle to the… — @nguyenha935

• feat(sse): session affinity (X-Session-Id / x-codex-session-id… — @tenshiak

• feat(sse): gemini-web now honors the OpenAI tools array by… (#7286)

• feat(eval): added a router-eval harness (npm run eval:router,… — @KooshaPari

• feat(services): introduce a ServiceProviderPlugin contract… (#7333)

• feat(routing): wire interceptFetch into the chat…

• feat(dashboard): confirm before removing a single… (#7361)

• feat(providers): Add a first-class xAI OAuth PKCE provider for… (#7399) — @fenix007

• feat(dashboard): surface in-product guidance for the Settings → Prompt… (#7530)

• feat(providers): Complete GHE Copilot OAuth provider implementation with… (#7546)

• feat(providers): grok-web's add-connection dialog now… (#7567)

• feat(providers): register lmstudio in the embedding provider registry… (#7601) — @ekinnee

• feat(sse): honor a no-auth provider connection's… (#7622)

• feat(dashboard): proxy-assignment UX quality-of-life fixes — the… — @tenshiak

• feat(providers): zai-web (chat.z.ai) now wires live… — @andrea-kingautomation

• feat(perplexity): Refresh Perplexity Web model mappings and Search API… (#7687) — @backryun

• Generic OpenAI-compatible model sync now captures a… (#6879)

• feat(dashboard): Kimi (Moonshot AI) official-partnership highlight on… (#7775)

• feat(providers): let any provider connection — built-in… (#7818)

• feat(routing): add a read-only `GET… (#7819)

• feat(providers): copilot-m365-web tone-selected model… (#7872)

• feat(shared): Add canonical numeric coercion helpers (toNumber,… (#7879)

• feat(mcp): add a narrow mcp:connect API-key scope for… (#7895)

• feat(dashboard): provider tab account search… (#7937)

• feat(sse): classify grok-web Cloudflare anti-bot blocks… (#8019)

• Teach the model the CCR retrieve protocol (marker →… (#8033)

• Add a per-model/endpoint compression exclusion filter:… (#8034)

• feat(i18n): zh-CN terminology glossary + consistency gate + 提供商→提供者… (#8038)

• feat(dashboard): The Codex quota card no longer shows latent, never-used… (#8051)

• feat(providers): native Fish Audio TTS provider on… (#8099)

• feat(codex): add bounded multi-reference PNG/JPEG/WebP image editing… (#8122) — @xiaoyaner0201

• refactor(sse): classify SSE critical-path empty catches… (#8142)

• feat(db): persist caller session tag into call_logs for… (#8249)

• feat(api): quota-aware fallback routing for web-fetch… (#8297)

• feat(providers): map upstream reasoning-level metadata… (#8347)

• feat(providers): weekly quota for xAI OAuth (Grok) (xai-oauth / xao)… (#8471) — @allanvb

• feat(jobs): backup auto enable schedule is now… (#8513)

• feat(ci): automate ratchet shrink-banking so file-size/complexity… (#8612) — @MumuTW

• feat(providers): live monthly credit quota for Firecrawl (`GET… (#8759) — @allanvb

• feat(search): add Firecrawl to POST /v1/search supported providers… (#8814) — @allanvb

• feat(adobe-firefly): reference-image attach for generate + OpenAI…

• Homologation suite: new npm run homolog runs the full…

• feat(mcp): add a read-only Local Corpus context source with…

• feat(providers): notion-web live model discovery via…

• Provider connections can now be shown or hidden…

• docs(i18n): rewrite Russian README as a full native…

• Providers: adds the Xiaomi MiMo Token Plan provider and a… (#8861)

• feat(opencode-plugin): auto-discover models while running + force sync (#8101) — @RaviTharuma

• feat(combo): enforce provider and model family invariants (#8304) — @RaviTharuma

• feat(cli): replace ANTHROPIC_SMALL_FAST_MODEL with Fable default (#8343) — @leszek3737

• feat: read INITIAL_PASSWORD env var during setup (#8439) — @linhdmn

• feat(providers): add missing opencode-go reasoning effort variants (#8441) — @Prudhvivuda

• feat: add Claude Opus 5 support (#8464) — @backryun

• feat(combos): add select all / unselect all in Browse Catalog (#8526) — @JoshimOfficial

• feat(cli-tools): add all Hermes Agent auxiliary model roles (#8543) — @leszek3737

• feat(ci): block stale UI translations when an English value is… (#8574)

• feat(providers): flatten multi-turn history for gemini-web (#8607) — @Prudhvivuda

• feat(sse): relay upstream 4xx error bodies verbatim on the… (#8622)

• feat: Claude Code discovery aliases (surface non-Claude… (#8666)

• feat(dashboard): copy-paste settings.json block for Claude Code discovery (#8722)

• feat(quality): temporary relax of complexity/file-size ratchets for… (#8767)

• feat(db): let the migration runner scan extra namespaced… (#8770)

• feat(api): prompt-cache health summary endpoint and analytics tab (#8827)

⚡ Performance

• perf(db): project columns + composite index in… (#6918) — @oyi77

• perf(db): add jitter to stagger due-on-restart connections (#6919) — @oyi77

• perf(startup): warm model catalog cache at module init (#6920) — @oyi77

• perf(db): add temp_store=MEMORY pragma to SQLite init (#6921) — @oyi77

• perf(db): cap modelLockouts eviction at 1000 entries (#6923) — @oyi77

• perf: wrap ComboCard, HeroSection in React.memo (#7070) — @oyi77

• perf: Date.now hoist, hasActiveDeltaValue hoist, buffer.split… (#7066) — @oyi77

• perf(memory): mitigate event-loop starvation under 3000+ provider… (#7719) — @oyi77

• perf: reduce long-context request copies (#7862) — @RaviTharuma

• perf: lazy provider init, P2C quota cache, structuredClone… (#7893) — @oyi77

• perf(api): singleflight version lookups (#8301) — @RaviTharuma

• perf(api): skip the full catalog build for quota-exclusive keys (#8771)

🐛 Bug Fixes

• fix: add re-entrancy guard to token health check sweep (#6917) — @oyi77

• fix(grok): strip reasoningEffort for grok cli models (#6938) — @CitrusIce

• fix(6954,6953): preserve system role + strip empty-signature thinking… (#6982) — @rafaumeu

• fix(6980): classify Cloudflare AI neuron exhaustion as… (#6983) — @rafaumeu

• fix(dashboard): hide disabled provider connections from combo builder (#6984)

• fix(providers): cap grok-cli tools at 200 for cli-chat-proxy (#6986)

• fix(6848): auto-cleanup for telemetry tables causing OOM (#6988) — @rafaumeu

• fix(models): preserve direct-model combo metadata (#6993) — @JxnLexn

• fix: DDG circuit breaker + null content validation (#7001) — @rafaumeu

• fix(models): preserve chat-capable image model rows (#7004) — @xz-dev

• fix(codex): preserve GPT-5.6 reasoning contract (#7012) — @xz-dev

• fix(base-red): align least-used combo tests with executionKey usage… (#7015)

• fix: infer bare models from active synced catalogs (#7028) — @guanbear

• fix(auggie): update model registry to match v0.32.0 CLI model IDs (#7032) — @oyi77

• fix(sse): register ollama-cloud in USAGE_FETCHER_PROVIDERS (#7041) — @alltomatos

• fix(quality): read cognitiveComplexity= machine line in… (#7042) — @alltomatos

• fix(providers): sanitize Claude native output_config.effort (#7050) — @xier2012

• fix(combo): treat maxInputTokens as an input-only cap in the… (#7052) — @xier2012

• fix(antigravity): collect native part.functionCall into tool calls (#7053) — @xier2012

• fix(responses): map mid-conversation system turns to developer role (#7056) — @xier2012

• fix(combo): least-used sorts by per-account executionKey (#7059) — @xier2012

• fix(providers): AgentRouter model import applies Claude Code wire image… (#7060) — @xier2012

• fix(translator): preserve thinking.budget_tokens: 0 in Claude->Gemini (#7061) — @xier2012

• fix(cloudflare-relay): avoid invalid regex syntax in generated worker (#7063) — @SeaXen

• fix(dashboard): strip browser-extension attrs before hydration (#7073) — @MrFadiAi

• fix(relay): bound Bifrost stream lifetime (#7093) — @KooshaPari

• fix(sse): recognize xiaomi-tokenplan mimo as a thinking-mode model (#7098)

• fix(codex): strip regex lookaround from tool schema patterns (#7100)

• fix(openai): strip reasoning_effort when GPT-5.x models carry… (#7101)

• fix(compression): Headroom SmartCrusher skips developer-role messages… (#7102)

• fix(providers): surface a warning on 404 model_not_found in… (#7103)

• fix(executors): forward X-Session-ID/X-Title agent metadata headers (#7104)

• fix(cli): verify better-sqlite3 native binary is actually loadable (#7105)

• fix(sse): sanitize non-ok Antigravity streaming error body (port… (#7106)

• fix(providers): add MiniMax image-generation provider (#7108)

• fix(sse): handle space-separated arg name/value in Composer tool… (#7116)

• fix(cli): remove MITM DNS spoof entries before killing server… (#7117)

• fix(dashboard): include never-tested connections in combo builder… (#7118)

• fix(api): check Vercel SSO-protection PATCH response on relay… (#7119)

• fix(combos): reject oversized fusion panels before fan-out (port… (#7120)

• fix(combo): detect empty content_block in streaming SSE peek (#7121)

• fix(oauth): resolve Kiro AWS SSO cache client credentials by… (#7122)

• fix(tests): vitest UI suite back to green (69 fails triaged — WS6.1) (#7127)

• fix(auto): use p95 fallback in speed factors (#7128) — @KooshaPari

• fix(models): update Anthropic model contextLength to 1M (#7129) — @HouMinXi

• fix(ci): raise dast-smoke timeout 12->25min (build alone eats up… (#7139)

• fix(compression): lazy-load typescript in RTK codeStripper so prod-lean… (#7164) — @alltomatos

• fix(providers): accept m365.cloud.microsoft for copilot-m365-web token (#7166) — @xier2012

• fix(executors): disable parallel tools for Codex Responses Lite (#7171) — @fenix007

• fix(tests+providers): env-dependent tests exposed by GH-hosted runners (#6634… (#7174)

• fix(combo): reject known context overflow without exhausting… (#7177) — @JxnLexn

• fix: add static.cloudflareinsights.com to CSP script-src (#7178) — @oyi77

• fix: extend turbopack ignoreIssue suppression to compression… (#7180)

• fix: recognize Ollama Cloud session usage-limit 429 as… (#7181)

• fix: preserve relayAuth for pool-referenced relay proxies (#7182)

• fix: wire adaptive context-budget dial into settings schema… (#7183)

• fix(providers): DuckDuckGo VQD 429 misclassified as 503 (#7185)

• fix(db): cap OOM probe-failure cycle in getDbInstance() (#7186)

• fix: stop opencode-go quota lookup defaulting to Z.AI… (#7187)

• fix(providers): refresh OpenCode (oc) free-tier model catalog (#7188)

• fix: include proxyId when testing a saved registry proxy (#7189)

• fix: sanitize non-Latin1 chars in combo diagnostic headers (#7190)

• fix: raise main server keepAliveTimeout/headersTimeout above… (#7191)

• fix: route zai-web (and other registry-entry web-cookie… (#7192)

• fix(providers): reject chat requests for cloud-agent-only jules provider (#7193)

• fix: restore mobile grid-cols-1 fallback on quota page card… (#7194)

• fix: wire modelAliases fetch into HermesAgentToolCard (#7195)

• fix: surface real claude-web error body for non-SSE 400s (#7196)

• fix(dashboard): agent bridge dns toggle uses POST, not PUT (#7197)

• fix: stop duplicating text in Gemini Web streamed responses (#7198)

• fix: filter hidden custom models out of legacy combo model… (#7199)

• fix(dashboard): implement missing handleToggleSource on Free Pool tab (#7200)

• fix: honor combo-level proxy assignments from the registry (#7201)

• fix(ci): run quality gates on Mergify merge-queue draft PRs… (#7202)

• fix: add dashboard-scoped typecheck gate covering… (#7203)

• fix(guardrails/chat): stop Vision Bridge hijacking credentialed models to… (#7204) — @artickc

• fix(translator): preserve Gemini thought parts as reasoning_content on… (#7206)

• fix(translator): register openai response projection for gemini clients (#7207)

• fix(cli): fast-path --version to skip full CLI bootstrap (#7208)

• fix: honor PROVIDER_LIMITS_SYNC_SPACING_MS for local/API-key… (#7214)

• fix(api): bulk-add API keys no longer overwrite existing… (#7234)

• fix(sse): route the public OpenAI GPT-5.6 family through the… (#7242)

• fix(providers): honor configured proxy on Grok Build egress (#7244)

• fix(nvidia): expand NIM chat model catalog (#7247)

• fix(sse): reconstruct Claude-format content in synthetic bypass… (#7248)

• fix(build): isolate Windows HOME/AppData during next build (#7249)

• fix(cli): omniroute dashboard respects PORT env when --port is… (#7252)

• fix(sse): project non-streaming JSON back to the… (#7255)

• fix(combo): fall back on Responses SSE failures (#7256) — @rushsinging

• fix(routing): resolve nested combo-ref panel members in fusion… (#7259)

• fix(usage): reset logs and show provider names in analytics (#7264) — @SeaXen

• fix(sse): silence noisy proxy-failure log on caller-initiated… (#7266)

• fix(codex): normalize nested Responses output content (#7269) — @JxnLexn

• fix(combo): derive session stickiness key from Responses API… (#7277) — @alltomatos

• fix(antigravity): wrap Pro fallback chain in try/catch for timeout… (#7290) — @HouMinXi

• fix(logs): show saved provider names in request/provider log views (#7294) — @SeaXen

• fix(stream): reconcile encrypted Codex reasoning visibility without… (#7304)

• fix(build): packed tarball boot crash — server-ws timeout import… (#7308)

• fix(skills): register cli-skill-collector in the agent-skills… (#7310)

• fix(db): tolerate unavailable virtual table modules in stats (#7313) — @megamen32

• fix(router-eval): retained-optimization gate cleanup (#7318) — @KooshaPari

• fix(ci): Coverage job timeout 10->20min (lcov reporter pushed it… (#7342)

• fix(electron): normalize hashed standalone externals (#7353) — @tianrking

• fix(db): stop a 'latest' path segment from disabling backups and… (#7359) — @danscMax

• fix(branding): regenerate raster favicons — white mark was shipped… (#7390) — @vzts

• fix(test): skip real DNS writes in MITM dynamic-import test (#7398) — @HouMinXi

• fix(antigravity): streaming passthrough for non-streaming clients (#7408) — @HouMinXi

• fix(build): align engines.node with SUPPORTED_NODE_RANGE (#7490) — @alltomatos

• fix(api): await params in Agent Bridge DNS route (Next.js 16) (#7492) — @alltomatos

• fix(dashboard): show Obsidian context source card (#7500) — @DKotsyuba

• fix(ci): fetch full base history in pr-test-policy (shallow… (#7501)

• fix(sse): preserve chat quota across mixed windows (#7504) — @webmasterarbez

• fix(oauth): surface sanitized device-code error instead of a… (#7511) — @danscMax

• fix(oauth): repair qwen + codebuddy-cn device-code endpoints (#7517) — @danscMax

• fix(mitm): strip trailing assistant prefill to prevent upstream… (#7520) — @chirag127

• fix(codex): Test probe uses a ChatGPT-account-supported model (#7524)

• fix(codex): validate refresh_token on import before persisting (#7525)

• fix(codex): non-stream chat 502 'Response body is already used'… (#7526)

• fix(oauth): surface tunnel hint when Codex OAuth runs on a remote… (#7527)

• fix(sse): preserve custom tool output images (#7540) — @loulanyue

• fix(combo): failover when upstream SSE is truncated mid-lifecycle (#7545) — @Chewji9875

• fix(dashboard): prefer public endpoint URLs (#7547) — @nguyenha935

• fix(cli): refresh runtime detection accurately (#7552) — @nguyenha935

• fix(ui): improve React Flow dark theme (#7553) — @nguyenha935

• fix(i18n): treat MISSING sync placeholders as absent in EN… (#7556)

• fix(cli): Windows cert check/uninstall key off the real CA… (#7557)

• fix(sse): feed compression pipeline the authoritative vision… (#7560)

• fix(dashboard): providers model-name filter matches live/synced catalog (#7561)

• fix(db): pre-init sql.js WASM ahead of any getDbInstance()… (#7562)

• fix(dashboard): resolve costs page 500 from out-of-scope t() in… (#7564)

• fix(dashboard): surface rate-limit warning on 429 chat-probe (#7565)

• fix(sse): lazy-load playwright in claudeTurnstileSolver (#7566)

• fix(sse): combo failover for OpenAI streams truncated without… (#7568)

• fix(cli): reuse win32-aware locateCommand in tool-detector (#7569)

• fix(codex): #7536 check content-type before touching response.body… (#7570)

• fix(sse): stop dropping tool_search and leaking OpenAI-only… (#7571)

• fix(api): resolve provider display name and dedup byModel on… (#7573)

• fix(mitm): route Claude Code standalone MITM traffic (#7574) — @dongwook-chan

• fix(sse): stop per-byte enumeration of binary image bytes in log… (#7576)

• fix(sse): split effort/reasoning suffix off pinned cursor model… (#7577)

• fix(chatgpt-web): recognize update_content.messages[] celsius WS frames (#7578)

• fix(sse): 401 model-not-supported lockout + sticky… (#7580)

• fix(antigravity): allow cloudcode envelope through messages guard (#7582) — @dongwook-chan

• fix(sse): sanitize empty-signature thinking blocks + hoist… (#7583)

• fix(sse): honor per-model targetFormat override for… (#7584)

• fix(sse): clamp glm-4.6v max_tokens to the 32768 ceiling (#7585)

• fix(cli): log Codex Responses WebSocket history/usage per logical… (#7588)

• fix(providers): derive static model catalogs for search providers from… (#7589)

• fix(stream-readiness): bump timeout for heavy Claude-format reasoning replicas (#7612) — @herjarsa

• fix(translator): synthesize tool call chunks from response.completed… (#7613) — @ekinnee

• fix(embeddings): add lmstudio to embedding provider registry (#7614) — @ekinnee

• fix(combo): auto-clear stale session pins and emit recovery hints… (#7625) — @herjarsa

• fix(providers): unify connection and routing flows (#7629) — @nguyenha935

• fix(db): dedupe bulk-imported proxies by full credential tuple (#7644) — @alltomatos

• fix(api): allow text-to-image on dual-modality models + revive… (#7648) — @danscMax

• fix(stryker): add Microsoft Designer test to tap.testFiles (#7659)

• fix(dashboard): cut UI import chain from connection persist module (CI… (#7677)

• fix(perplexity-web): stop empty-content responses from live schematized SSE (#6955) — @artickc

• fix(dashboard): make quota cards container responsive (#7027) — @xz-dev

• fix(nvidia): restore GLM-5.2 reasoning on NIM (#7296) — @backryun

• fix(i18n): complete Vietnamese dashboard localization and runtime… (#7493) — @nguyenha935

• fix(providers): migrate muse-spark-web from GraphQL to WebSocket… (#7528) — @Ajeesh25353646

• fix(combo): expose computed context_length via /api/combos for… (#7633) — @herjarsa

• fix(api): enumerate tiered auto combo endpoints in… (#7662) — @ekinnee

• fix(dashboard): topology reflects connection health + clears finished… (#7672) — @danscMax

• fix(kimi-coding): capture and replay reasoning for thinking-mode turns (#7673) — @xz-dev

• fix(ci): merge-train --fast mirrors test:unit subdir allowlist (#7688)

• fix(sse): start credential-health sweep at boot so stale web… (#7689) — @danscMax

• fix(cursor): discover models via official CLI command (#7692) — @makcimbx

• fix(quota): fix antigravity/agy multi-model quota skipping in combos (#7695) — @irvandikky

• fix(usage): preserve account identity history (#7700) — @xz-dev

• fix(db): update proxies on password rotation (#7707) — @floze-the-genius

• fix(providers): correct Chutes registry baseUrl (#7708)

• fix(routing): strip prompt_cache_key for NVIDIA NIM (#7709)

• fix(providers): degrade Arena (lmarena) cookie validation redirect to… (#7710)

• fix(claude-web): unify Turnstile/executor/fast-path User-Agents behind… (#7711)

• fix(sse): authenticate CLIProxyAPI fallback/passthrough legs with… (#7712)

• fix(sse): proactively refresh Grok Build OAuth token before… (#7715)

• fix(providers): classify ambiguous Mistral 401 instead of hard auth… (#7718)

• fix(security): bump adm-zip >=0.6.0 + exact host matching in mitm DNS… (#7732)

• fix(icons): fall back to Stepfun Mono when Color component is… (#7743) — @Dan-ex-hub

• fix(stream): suppress </think> close marker for Responses API… (#7747) — @xz-dev

• fix(sse): wire settings.wildcardAliases into model resolution (#7748)

• fix(authz): classify forge/jcode CLI settings routes as LOCAL_ONLY (#7749)

• fix(routing): honor eye-icon hidden models for no-auth providers in… (#7750)

• fix(sse): persist rotated Gemini web-session cookies via… (#7751)

• fix(docs): heal release-green docs drift + eslint any-suppression… (#7755)

• fix(mcp): copy undici into dist/node_modules to prevent… (#7756)

• fix(packaging): move fumadocs-mdx to devDependencies (#7757)

• fix(ci): build API-only smoke workflows backend-only to fix… (#7758)

• fix(cli): load DATA_DIR/server.env as fallback for .env on… (#7759)

• fix(cli): split outboundUrlGuard's DB helpers so setup-opencode… (#7760)

• fix(notion-web): production-ready labels, multi-workspace, inference,… (#7768) — @artickc

• fix(kimi): expose K3 reasoning effort levels (#7776) — @xz-dev

• fix(compression): apply compression combo assignments to routing combos (#7779) — @ekinnee

• fix(i18n): regenerate Polish UI locale from English (#7782) — @leszek3737

• fix(combo): retry transient errors in pipeline strategy (#7794) — @AndrianBalanescu

• fix(quality): register nvidia-quota-phase1 and… (#7796)

• fix(stream): synthesize terminal finish_reason chunk when upstream… (#7804) — @AndrianBalanescu

• fix(plugins): 5 bugs on the plugin path (3 Windows-only, 2… (#7806) — @tmone

• fix(cli): register ESM alias resolver for @/ paths under global… (#7808) — @rafaumeu

• fix(auth): gate invalid-key check on isRequireApiKeyEnabled for… (#7810) — @AndrianBalanescu

• fix(ci): repair release regressions exposed by clean runs (#7812) — @backryun

• fix(rerank): add voyage format adapter for request/response… (#7813) — @AndrianBalanescu

• fix(antigravity): attempt onboarding when projectId is empty (#5193… (#7815) — @rafaumeu

• fix(stream): emit terminal SSE frames on mid-stream upstream failure (#7816) — @AndrianBalanescu

• fix(sse): strip orphaned tool_use before antigravity/Vertex… (#7822)

• fix(translator): sanitize tool_result.tool_use_id symmetrically with… (#7823)

• fix(oauth): require chatgptUserId agreement for Codex account dedup (#7825)

• fix(db): purge in-memory key-health state when a provider… (#7826)

• fix(compression): keep a retrievable preamble instead of a bare CCR marker (#7827)

• fix(db): log fatal boot-time SQLite driver-cascade failure… (#7828)

• fix(docker): repair tls-client-node native binary after… (#7829)

• fix(auth): restore TICK_MS in tokenHealthCheck (ReferenceError on… (#7830)

• fix(cli): fix Windows CLI detection false negatives (#7753, #7774) (#7831)

• fix(docs): document CREDENTIAL_REDACTION_ENABLED and… (#7833)

• fix(dashboard): fix collapsed quota card session/weekly order (#7834)

• fix(dashboard): mirror connection-row action-icon spacing under RTL (#7835)

• fix: avoid cmd.exe spawn on Windows by using os.hostname()… (#7841) — @tientien17

• fix(usage): harden account identity reconciliation (#7843) — @xz-dev

• fix(cli): use rundll32 instead of cmd.exe for Windows browser… (#7844) — @tientien17

• fix: add native lifecycle-aware health endpoint (#7852) — @RaviTharuma

• fix: reserve chat admission before body parsing (#7853) — @RaviTharuma

• fix: bound quadratic session-dedup memory growth (#7855) — @RaviTharuma

• fix(compression): enable OmniGlyph for Claude Fable 5 (#7863) — @enjoyer-hub

• fix(notion-web): add browser fingerprint headers to reduce Cloudflare… (#7864) — @HassiyYT

• fix(mitm): gate Agent Bridge Repair on sudo password (#7865) — @skutanjir

• fix(rerank): honor the connection's pinned proxy on rerank calls (#7867)

• fix(compression): skip CCR on tool outputs to preserve agent loop (#7869) — @herjarsa

• fix(vision-bridge): reroute auto/ prefix to vision model when images present (#7871) — @herjarsa

• fix(opencode-plugin): support separate management read token (#7885) — @RaviTharuma

• fix(sse): CC bridge loses OpenAI-format image input… (#7888)

• fix(combo): strip boolean reasoning field for opencode-go providers (#7891) — @AndrianBalanescu

• fix(notion-web): accept OpenAI content-parts arrays in transcript (#7896) — @artickc

• fix(notion-web): reuse threadId across OpenAI multi-turn (no new chat… (#7900) — @artickc

• fix(gemini): strip OpenAI "strict" tool-schema keyword for… (#7901) — @Witroch4

• fix(antigravity): collect native functionCall parts in SSE collector (#7902) — @Witroch4

• fix(sse): recover invalid Anthropic thinking signatures once (#7906) — @insoln

• fix(resilience): don't cool down accounts or trip the breaker on client… (#7908) — @insoln

• fix(dashboard): preserve quota cutoff drafts (#7909) — @hydraxman

• fix(providers): treat public-host 302 as valid in Gemini Web connection… (#7917)

• fix(providers): read reasoning_text in Claude-format response translator (#7919)

• fix(dashboard): safely render structured error objects in Request Logs… (#7920)

• fix(dashboard): repair monaco deep import broken by 0.56 exports map (#7922)

• fix(autostart): adopt 9Router VBS startup to suppress console flash on… (#7925) — @tientien17

• fix(translators): normalize TitleCase tool names for non-Anthropic models (#7926) — @nramabad

• fix(api): resolve local provider models via dashboard catalog… (#7927) — @ekinnee

• fix(auto): pool accounts by provider model (#7928) — @adrianaryaputra

• fix(perplexity-web): multi-step empty content + advanced-quota cooldown (#7930) — @artickc

• fix(ccr): resolve principal via OMNIROUTE_API_KEY env var on… (#7932) — @ekinnee

• fix(combo): context-aware fallback ignores model_context_override (#7933) — @tmone

• fix(i18n): preserve remaining Vietnamese localization (#7935) — @nguyenha935

• fix(mitm): gate Agent Bridge DNS and Trust Cert on sudo password (#7939) — @skutanjir

• fix(providers): route iflytek/sparkdesk to Spark's OpenAI-compatible… (#7942) — @FenjuFu

• fix(sse): preserve parallel_tool_calls for GPT-5.6 delegation… (#7957)

• fix(providers): copilot-m365-web fails loudly on empty turns +… (#7958)

• fix(providers): treat unreliable web-cookie /models probe status as… (#7959)

• fix(api): add amazon-q to the static model catalog (#7960)

• fix: parse Gemini 429 RetryInfo.retryDelay for model lockout (#7961)

• fix(quality): tolerate ESLint's trailing unpruned-suppressions text… (#7962)

• fix(cli): translate missing sqlite bindings error into actionable… (#7963)

• fix(cli): spawn opencode.cmd shim with shell:true on win32 (#7964)

• fix(dashboard): correct block-extra-Claude-usage toggle copy to match… (#7965)

• fix(api): classify /api/acp/agents as loopback-only (#7966)

• fix(auth): restore configurable HEALTHCHECK_BATCH_SIZE dropped by… (#7970)

• fix(test): widen ratelimit-admission pollUntil deadline to 10s (#7971)

• fix(pricing): clarify disabled automatic sync status (#7972) — @RaviTharuma

• fix(combo): exempt content_filter from empty-content detection (#7973) — @HouMinXi

• fix(embeddings): support secure multimodal inputs (#7978) — @RaviTharuma

• fix(resilience): cap exactCooldownMs against maxCooldownMs (#7980) — @ekinnee

• fix(electron): derive macOS Helper name from execPath to remove 2nd… (#8002)

• fix(chatcore): report string-reason client aborts as 499, not 502 (#8011) — @Long-Feeds

• fix(models): drop generic catalog siblings of specialty surfaces (#8021) — @RaviTharuma

• fix(models): stop inventing chat capabilities for specialty surfaces (#8022) — @RaviTharuma

• fix(capabilities): resolve models.dev specialty rows across provider keys (#8023) — @RaviTharuma

• fix(models): attach models.dev pricing to GET /v1/models entries (#8025) — @RaviTharuma

• fix(grok-cli): require full auth.json on OAuth paste import (#8027) — @RaviTharuma

• fix(grok-cli): sanitize function_call_output before Grok Build dispatch (#8030) — @RaviTharuma

• fix(sse): bound forwarded response headers (#8041) — @insoln

• fix(sse): replace spoofable .includes() PromptQL issuer check… (#8042)

• fix(sse): bound Codex SSE peek read with per-read timeout (#8043)

• fix(cli): stop double-prefixing combo model ids in opencode… (#8047)

• fix(antigravity): scope 404 model-not-found lockout to exact model +… (#8050) — @AndrianBalanescu

• fix: repair pre-existing red gates on the release/v3.8.49 tip (#8055)

• fix(oauth): honor connectionId on token refresh so email-less… (#8062) — @insoln

• fix: classify Google quota exhaustion responses (#8071) — @rafaumeu

• fix(providers): refresh duckduckgo-web catalog to current Duck.ai wire… (#8079)

• fix(security): decouple request PII redaction from injection mode (#8102) — @RaviTharuma

• fix(providers): discover live AGY models (#8123) — @adevwithpurpose

• fix(guardrails): align INPUT_SANITIZER request masking gate (#8124) — @RaviTharuma

• fix(providers): refresh Baidu ERNIE and Qianfan website URLs (#8128) — @TrackCrewGalore

• fix(stream): add logging to empty catch blocks in stream error… (#8143) — @chirag127

• fix(sse): stop Codex/Responses sanitizer turning system image_url… (#8147)

• fix(db): register SIGHUP handler and stop force-killing server… (#8148)

• fix(providers): add missing poe registry baseUrl entry (#8149)

• fix(routing): anchor quota cache on globalThis for cross-chunk… (#8150)

• fix(responses): close namespace round-trip for Responses-Chat… (#8151) — @RCrushMe

• fix(oauth): warn instead of silently opening unreachable localhost… (#8152)

• fix(db): stop closing the sql.js singleton in getDbInstance()… (#8153)

• fix(sse): run compression pipeline per turn in Codex Responses WS… (#8154)

• fix(cli): merge node bin dir into CLI healthcheck PATH for codex… (#8156)

• fix(sse): anonymous fingerprint fallback for keyless Pollinations… (#8157)

• fix(cli): surface the real spawn error in process supervisor (#8158)

• fix: strip internal reasoning placeholder from user-visible… (#8162) — @Dingding-leo

• fix(combos): expose synced reasoning-effort variants in Combo… (#8165) — @Dingding-leo

• fix(windows): add windowsHide to all child process spawns (#8167) — @Dingding-leo

• fix(cursor): bridge native tools to client calls (#8171) — @makcimbx

• fix(security): bound JWT-extraction regexes to prevent polynomial… (#8173)

• fix: log pending request counter decrement failures (#8179) — @rafaumeu

• fix: suppress sql.js build warning via non-analyzable… (#8184) — @rafaumeu

• fix: align INPUT_SANITIZER_ENABLED default to true across… (#8185) — @rafaumeu

• fix(combo): skip remaining same-provider targets on 401/403 auth… (#8195) — @rafaumeu

• fix(compression): make memo key model-independent for non-vision engines (#8196) — @rafaumeu

• fix(resilience): add max/step to NumberField for provider cooldown inputs (#8203) — @rafaumeu

• fix(providers): fix Azure AI Foundry multi-model discovery and… (#8206) — @not-knope

• fix(logs): stop the async-EPIPE log-flood loop at its ignition… (#8207) — @Tasogarre

• fix(sse): surface OpenRouter mid-stream error chunks instead of a… (#8210) — @hartmark

• fix(sse): Gemini malformed function-call handling + tool_choice… (#8211) — @hartmark

• fix(sse): tool-incapable provider handling (AI Horde + Responses… (#8212) — @hartmark

• fix(sse): Gemini TPM/RPD quota classification + combo… (#8213) — @hartmark

• fix(services): resolve and record a real pid when adopting a service (#8218) — @seanford

• fix(memory): resolve remote embedding dimensions for reindex (#8220) — @Prudhvivuda

• fix(dashboard): correct machine-translated Korean UI strings in ko.json (#8224) — @MichaelYcJo

• fix(devin-cli): refresh shared model catalog (#8227) — @backryun

• fix(claude-web): align session transport and fallback (#8230) — @backryun

• fix: restore OAuth auto-refresh for gemini-cli connections (#8232) — @seanford

• fix: normalize Codex URLs and dashboard regressions (#8233) — @nguyenha935

• fix(api): narrow claudeClassifierCompat auto trigger so… (#8236)

• fix(gemini): drop HARM_CATEGORY_CIVIC_INTEGRITY from the default… (#8238)

• fix(backend): word-boundary-safe tool-result truncation in lite… (#8239)

• fix(providers): filter unsupported family-fallback candidates against… (#8240)

• fix(translator): synthesize tool call chunks from response.completed… (#180 #3980)

• fix(api): Vercel Relay deploy now checks the Deployment… (#1037) — @ricatix

• fix(oauth): resolve Kiro AWS SSO cache client credentials by… — @XCrag

• fix(combo): streaming Claude responses whose content block opens… (#1382) — @heishen6

• fix(codex): strip regex pattern lookaround (lookahead/lookbehind)… (#7100) — @evinjohnn

• fix(cli): stopMitm() now removes /etc/hosts DNS-spoof entries… — @dionisius95

• fix(sse): Cursor Composer/Auto tool calls that separate the arg… — @way-art

• fix(dashboard): the "Custom Models" add/edit form now has a "Vision… — @nguyenphi37

• fix(combos): fusion combos now reject an oversized panel (>40 models… — @fontvu

• fix(providers): the OpenAI-compatible "Check" validation flow now… — @advane204f

• fix(dashboard): include never-tested custom provider connections in the… — @fajarbossit

• fix(executors): forward agent-supplied X-Session-ID/X-Title… (#7104) — @chitholian

• fix(sse): Antigravity streaming requests that hit a non-ok… — @Duongkhanhtool

• fix(providers): MiniMax Text-to-Image now works — a minimax… — @felipeleite

• fix(cli): the runtime self-heal now verifies a cached… (#2493) — @mrprohack

• fix(openai): strip reasoning_effort/reasoning for GPT-5.x models… — @techsolutionmta

• fix(providers): preserve relayAuth for… (#5716)

• fix(providers): wire the Devin cloud-agent provider… (#6142)

• fix(providers): refresh Baidu ERNIE + Qianfan provider website URLs to… (#6271) — @TrackCrewGalore

• fix(providers): honor a provider-level proxy assigned… (#6272)

• fix(api): merge tool_call continuation deltas that… (#6276)

• fix(providers): modernize the lmarena provider for the Arena.ai… (#6280) — @backryun

• fix(providers): web-provider model discovery updated — qwen-web uses… — @janeza2

• fix(logs): the request-log detail modal no longer reopens by… — @xz-dev

• fix(providers): update SenseNova Token Plan support — register the… — @xz-dev

• fix(providers): give v0-vercel-web its own alias so its… (#6343)

• fix(providers): route AgentRouter key validation… (#6377)

• fix(db): stop legacy log-archive migration from…

• fix(docs): document Turbopack build memory tradeoff and… (#6409)

• fix(compression): surface silently-dropped…

• fix(providers): honor the max_token capability… (#6524)

• fix(dashboard): the onboarding tier-flow diagram rendered broken — its… — @ianriizky

• fix(routing): the auto combo's no-auth candidate pool now honors a… (#6557)

• fix(sse): server-tool literal names (e.g. web_search) are… — @MikeTuev

• fix(sse): sanitize non-Latin1 characters before… (#6612)

• fix(api): recognize OpenRouter… (#6623)

• fix(db): share one in-flight sql.js load across… (#6628)

• fix(db): unwrap lone named-parameter objects before… (#6802)

• fix(db): break probe-failed/restore loop on large storage.sqlite: (#6632 ). — @KooshaPari

• fix(ci): exclude check-test-masking.test.ts's own… (#6634)

• fix(routing): recognize Kimi-style "exceeded model… (#6637)

• fix(cli): Claude Code installed via WinGet is now detected on… — @enjoyer-hub

• fix(providers): removed obsolete/defunct providers from the catalog… — @backryun

• fix(sse): requests rejected before handleChatCore… (#6698)

• fix(providers): reject chat-completions requests for… (#6699)

• fix(sse): unwrap bare {function:{…}} tools so OpenAI-shape… — @samir-abis

• fix(oauth): stop merging distinct Codex OAuth logins that share an… — @lucasjustinudin

• fix(codex): detect "model at capacity"/overloaded errors embedded… — @ryanngit

• fix(volcengine): clamp max_tokens to the VolcEngine Ark endpoint cap… — @whale9820

• fix(antigravity): surface aborted/malformed Gemini tool calls (e.g.… — @anhdiepmmk

• fix(routing): the reasoning-token headroom buffer clamps to the… (#6714) — @xz-dev

• fix(api): omniroute health (and health components/`health… (#6677 #6717)

• fix(startup): webpack build broke on case-insensitive filesystems… (#6718)

• fix(build): Turbopack production build emitted an "Overly broad… (#6582 #6720)

• fix(providers): Codex Desktop requests to gpt-5.3-codex-spark failed… (#6651 #6721) — @alltomatos

• fix(providers): the provider quota card's weekly/session bars re-sorted… (#6687 #6722)

• fix(i18n): pt-BR was missing 194 UI keys present in en.json — a… (#6695 #6723)

• fix(startup): omniroute --mcp crashed at Node ESM link time with… (#6559 #6725)

• fix(providers): Kiro sent the adaptive-thinking… (#6576 #6726)

• fix(translator): Cursor's local Subagent tool call is no longer… — @like3213934360-lab

• fix(translator): GLM 5.2 (and other OpenAI-compatible upstreams that… — @itiwant

• fix(resilience): OmniRoute didn't respect an exhausted Ollama Cloud (or… (#6638 #6731)

• fix(resilience): a combo step "pinned" to one fingerprint account… (#6696 #6732)

• fix(api): Responses passthrough emitted event-only SSE frames (no… (#6561 #6735)

• fix(compression): /api/compression/preview's top-level… (#6488 #6741)

• fix(resilience): account selection could pick an account already out of… (#6686 #6742)

• fix(api): reasoning_content (extended-thinking text) was… (#6662 #6743)

• fix(api): the compression config PUT schema now accepts… — @alltomatos

• fix(api): raised the provider apiKey length cap for… — @alltomatos

• fix(routing): fusion combos no longer silently drop combo-ref panel… (#6764)

• fix(ci): publish electron-updater latest*.yml… (#6766)

• fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768): (#6769 ). — @chirag127

• fix(providers): strip redundant node prefix when… (#6772)

• fix(providers): scope nvidia NIM 404s to the single… (#6773)

• fix(codex): bump the default Codex CLI client identity from… (#6780) — @quanturbo

• fix(ci): the blocking "Impacted unit tests (TIA)" step… (#6788)

• fix(translator): read PDF/video file_data attachments on the… — @Witroch4

• fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED: (#6791 ). — @Pitchfork-and-Torch

• fix(api): the compression config PUT schema… — @Pitchfork-and-Torch

• fix(electron): materialize Turbopack hashed-module symlinks during packaging (#6724, #6594): (#6794 ). — @huohua-dev

• fix(cursor): send the Agent CLI build id as… — @andrewmunsell

• fix(cli): waitForServer() no longer reports ready from… (#6800)

• fix(sse): de-flake timing-sensitive combo… (#6803)

• fix(codex): strip include from compact responses requests: (#6805 ). — @yinaoxiong

• fix(dashboard): surface Claude extraUsage credits in… (#6806)

• Request count by provider & date: Dashboard → Analytics now shows a dedicated table of… (#6812) — @tjengbudi

• fix(resilience): an Ollama Cloud (or any apikey-category provider)… (#3709 #6817)

• fix(providers): an explicit thinking.budget_tokens: 0 is now honored… — @alltomatos

• fix(bootstrap): filter empty process.env values before spawning… — @AndrianBalanescu

• fix(providers): classify upstream 404 responses as MODEL_NOT_FOUND… — @AndrianBalanescu

• fix(db): cap the sql.js OOM-during-probe path in… (#6632 #6835)

• fix(mcp): de-duplicate TOTAL_MCP_TOOL_COUNT by tool… (#6854)

• fix(usage): xAI's exact provider-reported cost_in_usd_ticks no… (#6856) — @KooshaPari

• fix(plugin): the @omniroute/opencode-plugin dynamic provider hook… (#6859)

• fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI… (#6876)

• fix(sse): defer response.completed until a trailing… (#6906)

• fix(cli): ship head-response-guard.cjs into the standalone… (#6908)

• fix(sse): wire the shared quota-fetch throttle into… (#6911)

• fix(sse): rename client-sent max_completion_tokens to… (#6912)

• fix(providers): PROVIDER_LIMITS_SYNC_SPACING_MS now… (#6916)

• fix(sse): classify LAN embeddings providers (10/8,… (#6925)

• fix(sse): Qwen Web executor no longer sends `[object… (#6927)

• perf(api): relay chat-completions routes now thread the… (#6930)

• fix(sse): normalizeCodexMessageContentPart now… (#6932)

• fix(sse): omit removed attachments field from Muse… (#6935)

• fix(dashboard): label audio/embeddings/image compatible… (#6936)

• fix(api): model-list discovery for LAN-local… (#6939)

• fix(providers): openai->gemini transform now maps… (#4170) — @rafaumeu

• fix(sse): escape backslash before brackets in ChatGPT-web… (#6944) — @brick30llc-ctrl

• fix(oauth): tokenHealthCheck now lowercase-normalizes… (#6947)

• fix(sse): make Codex Responses tool-arg normalization… (#6951)

• fix(sse): drop internal commentary-phase Responses… (#6952)

• fix(sse): stop forwarding empty-signature thinking… (#6953)

• fix(sse): perplexity-web's default pplx-auto/pplx-sonar… — @artickc

• fix(combos): embeddings-only and rerank-only models (e.g. JinaAI,… (#6975)

• fix(combos): when 2+ distinct model ids from the same provider would… (#6957)

• fix(dashboard): the combos builder now hides provider connections the… — @attid

• fix(providers): cap grok-cli tools at 200 per request, matching xAI's… — @gitcommit90

• fix(providers): DuckDuckGo AI Chat executor propagates… (#6996)

• fix(providers): refresh OpenCode (oc) free-tier model… (#6998)

• fix(api): raise the main server's… (#7003)

• fix(compression): wire the adaptive context-budget… (#7005)

• fix(usage): stop opencode-go quota lookup from… (#7022)

• fix(providers): Auggie (Augment CLI) model registry updated to the real… — @oyi77

• fix(ci): add a dashboard-scoped typecheck gate covering… (#7033)

• fix(cli): omniroute dashboard (no --port flag) now respects… — @kaon0388v1

• fix(build): extend the Turbopack ignoreIssue… (#7051)

• fix(providers): web-cookie… (#7058)

• fix(resilience): recognize Ollama Cloud's 5-hour… (#7071)

• fix(dashboard): restore mobile single-column fallback… (#7072)

• fix(dashboard): include proxyId when testing a saved… (#7080)

• fix(sse): xiaomi-tokenplan mimo models (e.g. mimo-v2.5-pro)… (#7098) — @xxue-z

• fix(dashboard): align onboarding tier descriptions and localize the… (#7125) — @Wibias

• fix(sse): claude-web now surfaces the real upstream error body… (#7134)

• fix(db): honor combo-level proxy assignments from the… (#7149)

• fix(dashboard): wire modelAliases fetch into… (#7151)

• fix(dashboard): filter hidden custom models out of the… (#7156)

• fix(dashboard): Agent Bridge DNS toggle now sends POST… (#7157)

• fix(dashboard): implement missing handleToggleSource… (#7161)

• fix(sse): stop duplicating text in Gemini Web streamed… (#7163)

• fix(executors): Codex Responses Lite requests force serial tool calls… (#7171) — @fenix007

• fix(translator): preserve Gemini thinking-mode thought:true parts as… — @warelik

• fix(translator): register the missing OpenAI→Gemini response projection… — @warelik

• fix(cli): omniroute --version now fast-paths before the tsx/esm… — @Jordannst

• fix(ci): build dast-smoke and nightly API-only smoke… (#7226)

• api: bulk-add API keys no longer overwrite existing provider… — @asynx6

• fix(sse): feed the compression pipeline the… (#7237)

• fix(sse): route the public OpenAI GPT-5.6 family (gpt-5.6,… — @Jordannst

• fix(providers): honor a configured proxy on Grok Build egress — the… — @ryanngit

• fix(nvidia): expand NIM chat model catalog with newly-observed… — @spacesky-cell

• fix(sse): synthetic bypass responses for Claude-format clients no… — @KunN-21

• fix(build): isolate Windows HOME/AppData during next build. (thanks… — @KunN-21

• fix(dashboard): providers model-name filter now matches… (#7250)

• fix(docs): correct stale /api/version and… (#7253)

• fix(sse): project non-streaming JSON responses back to… (#7255) — @warelik

• fix(i18n): treat __MISSING__: sync-script… (#7258)

• fix(authz): classify /api/cli-tools/forge-settings and… (#7263)

• fix(sse): lazy-load playwright in claudeTurnstileSolver… (#7265)

• fix(sse): stop logging a caller-initiated request abort/timeout… — @TuyulSpam

• fix(sse): classify 401 "model X is not supported" as… (#7268)

• fix(dashboard): resolve `ReferenceError: t is not… (#7272)

• fix(cli): Windows MITM root-CA check/uninstall keyed… (#7275)

• fix(cli): reuse cliRuntime's win32-aware… (#7279)

• fix(dashboard): connection Test surfaces a rate-limit… (#7284)

• fix(sse): combo failover now detects OpenAI-shape… (#7285)

• fix(db): getDbInstance() now guarantees sql.js WASM has…

• fix(sse): split effort/reasoning suffix off pinned… (#7289)

• fix(sse): hoist client-injected system messages to… (#7293)

• fix(sse): treat Uint8Array/Buffer as opaque binary in… (#7297)

• fix(cli): load DATA_DIR/server.env as a fallback for… (#7302)

• fix(rerank): Honor the connection's pinned proxy on rerank calls, so… (#7350) — @kamenkadmitry

• fix(electron): Normalize hashed Turbopack external imports in packaged… (#7353) — @tianrking

• fix(chatgpt-web): recognize update_content.messages[]… (#7357)

• fix(sse): clamp glm-4.6v max_tokens to the 32768… (#7364)

• fix(sse): honor per-model targetFormat override for… (#7364)

• fix(sse): combo session stickiness now releases a… (#7387)

• fix(cli): log Codex Responses WebSocket history/usage… (#7388)

• fix(embeddings): remove the non-existent… — @kamenkadmitry

• fix(providers): expose a base-URL override for… (#7447)

• fix(build): align engines.node supported range… (#7446)

• fix(i18n): replace machine-bulk-filled Vietnamese UI… (#7493)

• fix(db): stop closing the single sql.js singleton… (#7494)

• fix(sse): stop stream readiness from treating a… (#7503)

• Fixed the Codex connection Test button always… (#7521)

• The Codex account import (`POST… (#7522)

• The PKCE OAuth start… (#7523)

• fix(providers): search providers now expose a static… (#7529)

• fix(sse): map tool_search to a Chat function tool… (#7532)

• fix(sse): gate verbosity/prompt_cache_key on OpenAI… (#7533)

• fix(api): Usage page "by provider" table now shows the… (#7534)

• fix(api): Usage page "model usage" table no longer… (#7535)

• fix(codex): non-stream Codex (ChatGPT-account) chat no… (#7536)

• fix(sse): preserve input_image parts in array-valued Codex… (#7540) — @loulanyue

• fix(providers): stop reporting Arena (lmarena) cookie… (#7542)

• fix(combo): streaming combo failover now fails over when an… (#7545) — @Chewji9875

• fix(dashboard): Public and managed tunnel endpoints now take precedence… (#7547) — @nguyenha935

• fix(claude-web): unify Turnstile solver, executor and… (#7548)

• fix(cli): fall back to the node:sqlite driver cascade… (#7586)

• fix(api): expose Responses-API-format (OpenAI/Codex)… (#7587)

• grok-cli: OAuth paste-import now requires the full… (#7610)

• fix(sse): proactively refresh Grok Build's expiring… (#7610)

• grok-cli: sanitize Responses function_call_output.output values… (#7611)

• fix(translator): guard against double-emission when response.completed…

• fix(routing): strip prompt_cache_key for NVIDIA NIM —… (#7617)

• fix(routing): honor eye-icon hidden models for no-auth… (#7620)

• fix(providers): correct Chutes registry baseUrl from… (#7621)

• fix(providers): unify connection status across… (#7629)

• fix(providers): classify Mistral ambiguous 401 (quota… (#7638)

• fix(sse): route CLIProxyAPI fallback/passthrough legs… (#7645)

• fix(packaging): move fumadocs-mdx from dependencies to… (#7661)

• GET /api/combos/auto now enumerates template variants…

• fix(sse): persist rotated Gemini web-session cookies… (#7676)

• fix(dashboard): mirror connection-row action-icon… (#7680)

• fix(cli): split outboundUrlGuard.ts's DB/feature-flag… (#7682)

• fix(sse): wire settings.wildcardAliases into model… (#7693)

• fix(mcp): copy undici into dist/node_modules to prevent… (#7701)

• fix(translator): sanitize tool_result.tool_use_id symmetrically with… (#7705)

• fix(db): bulk proxy imports now update an existing proxy when… (#7707) — @floze-the-genius

• fix(oauth): stop Codex OAuth completion from collapsing… (#7737)

• fix(db): purge in-memory API-key health/rotation state… (#7740)

• perf(db): the 5 provider-connection/node call sites 's IC2… (#7787 #7744) — @oyi77

• fix(compression): CCR no longer collapses a whole… (#7746)

• fix(sse): strip orphaned tool_use blocks before… (#7752)

• fix(cli): resolve Windows CLI detection false negatives…

• fix(dashboard): keep session/weekly quota rows in a… (#7764)

• fix(db): log the fatal boot-time SQLite driver-cascade… (#7773)

• fix(sse): Claude-Code-compatible bridge (AgentRouter and any CC… (#7777) — @beingshafin

• perf(db): getProviderConnections now reads from a shared… (#7787) — @oyi77

• fix(docs): document CREDENTIAL_REDACTION_ENABLED and… (#7793)

• fix(combo): retry intermediate pipeline-strategy steps… — @AndrianBalanescu

• fix(docker): repair tls-client-node native binary after… (#7802)

• fix(runtime): Apply refreshed request-queue settings, restore… (#7812)

• fix(oauth): attempt Antigravity onboarding inline when… (#7814)

• fix(api): add amazon-q to the static model catalog so… (#7820)

• fix(sse): preserve parallel_tool_calls for GPT-5.6… (#7821)

• fix(quality): tolerate ESLint's trailing… (#7837)

• fix(test): widen ratelimit-admission pollUntil deadline… (#7842)

• fix(cli): Windows omniroute dashboard browser fallback uses… (#7844)

• fix(dashboard): Request Logs detail modal no longer… (#7845)

• fix(backend): stop buildClientRawRequest deep-cloning… (#7847)

• fix(sse): copy the combo attempt body shallowly instead… (#7847)

• fix(sse): estimate the combo fallback-compression… (#7847)

• fix(providers): Copilot reasoning_text now surfaces in… (#7856)

• fix(providers): treat a non-401/403 response from the… (#7857)

• fix(providers): copilot-m365-web now fails loudly on a…

• fix(providers): Gemini Web connection test now accepts… (#7859)

• fix(cli): translate missing better-sqlite3 native… (#7868)

• fix(auth): restore HEALTHCHECK_BATCH_SIZE env-var… (#7875)

• fix(opencode-plugin): the official @omniroute/opencode-plugin now accepts… (#7884) — @RaviTharuma

• fix(dashboard): Provider Quota cutoff inputs preserve unsaved values… (#7889)

• fix(sse): Anthropic requests that reject a completed historical… (#7906)

• Chat Core: client aborts that reject the upstream fetch with a raw…

• fix(resilience): Client-aborted requests are now treated as client… (#7907)

• fix(cli): spawn the win32 opencode.cmd shim with… (#7913)

• fix(dashboard): correct "Block extra Claude usage"… (#7918)

• fix(autostart): Windows auto-start no longer flashes a console window —… (#7925)

• fix(providers): perplexity-web now detects the… (#7930) — @artickc

• fix(sse): parse Gemini 429 RetryInfo.retryDelay /… (#7940)

• fix(electron): resolve macOS Helper by binary name to… (#7941)

• fix(providers): iFlytek Spark (iflytek, sparkdesk) now target the… (#7942) — @FenjuFu

• fix(api): classify /api/acp/agents as loopback-only… (#7948)

• fix(cli): stop double-prefixing combo model ids in the… (#7976)

• fix(providers): route noauth opencode-zen connections… (#7993)

• fix(providers): refresh duckduckgo-web free model… (#8000)

• fix(providers): repoint the zai-web executor at… (#8014)

• fix(sse): bound the Codex SSE peek/passthrough body… (#8020)

• fix(sse): replace spoofable .includes() PromptQL… (#8029)

• fix(providers): path-shaped multimodal model ids (e.g.… (#8032) — @Prudhvivuda

• fix(cli): merge Node's own bin dir into the CLI… (#8036)

• fix(sse): Bound forwarded upstream response headers so large… (#8041) — @insoln

• fix(db): register SIGHUP handler and stop force-killing… (#8045)

• fix(oauth): warn instead of silently opening an… (#8046)

• fix(sse): run the prompt-compression pipeline per turn in the… (#8052)

• fix(oauth): Refreshing the token on an email-less OAuth connection… (#8059)

• fix(routing): anchor quota routing cache on globalThis… (#8065)

• fix(providers): add the missing poe REGISTRY entry so built-in Poe… (#8082)

• fix(translator): set status: "completed" on… (#8083)

• fix(sse): give keyless Pollinations image requests the… (#8085)

• fix(sse): stop Codex/Responses sanitizer from turning… (#8089)

• fix(cli): surface the real spawn error… (#8091)

• fix(antigravity): preserve request/tool fidelity, make credits modes… (#8098) — @nguyenha935

• fix(dashboard): clamp provider-cooldown min/max ms to… (#8107)

• fix(providers): filter unsupported family-fallback… (#8134)

• fix(providers): classify HTTP 400 model-unavailable as… (#8136)

• fix(backend): word-boundary-safe tool-result truncation… (#8169)

• fix(api): narrow claudeClassifierCompat auto trigger so… (#8189)

• fix(providers): carve cookie-auth providers out of… (#8200)

• fix(gemini): drop HARM_CATEGORY_CIVIC_INTEGRITY from… (#8231)

• fix(dashboard): Normalize Codex client URLs, restore the analytics… (#8233) — @nguyenha935

• fix(providers): classify per-model-quota 403 and…

• fix(providers): reconcile Kimi K3 vision metadata when synced… (#8250) — @Prudhvivuda

• fix(providers): the Providers page Learn more button now opens the… (#8284) — @KaynXu

• fix(api): fold namespace into the flattened Chat tool… (#8295)

• fix(runtime): sanitize Muse Spark fetch failures before logging and… (#8298) — @backryun

• fix(sse): Combo middleware preserves OpenAI Responses request… (#8310) — @ridho9

• fix(api): accept the current compatible-provider… (#8326)

• fix(api): stop leaking the internal provider UUID in… (#8327)

• fix(dashboard): show custom provider_nodes providers in… (#8328)

• fix(api): stop the 2000-token safety buffer from… (#8331)

• fix(backend): keep combo routing from dispatching image… (#8332)

• fix(sse): strip third-party-agent signals from the… (#8350)

• fix(i18n): Restore brand/model proper nouns (Claude, OpenAI,… — @ikelvingo

• fix(api): estimate inline base64 image tokens instead… (#8368)

• fix(backend): stop prompt-cache affinity from silently… (#8370)

• fix(api): accept a missing status query-param on GET… (#8374)

• fix(resilience): treat an unreachable-proxy… (#8376)

• fix(backend): make disabling the global per-key proxy… (#8385)

• fix(dashboard): persist compression engine detail… (#8388)

• fix(plugins): fire registered+active plugin hooks… (#8395)

• fix(resilience): cap the connection cooldown after a… (#8396)

• fix(api): reach synced model_capabilities rows for… (#8429)

• fix(providers): stop marking a multi-quota-window… (#8431)

• fix(backend): compute AgentBridge diagnose… (#8466)

• fix(providers): OpencodeExecutor honors Extra API Keys rotation via… (#8467) — @Prudhvivuda

• fix(sse): stop combo's "all targets failed" response… (#8486)

• fix(backend): capability filters fail closed when every combo target… (#8488) — @Prudhvivuda

• fix(providers): persist a runtime-discovered… (#8491)

• fix(cli): backup create / backup auto enable —… (#8512)

• fix(dashboard): Endpoint/API base URL display honors… (#8514) — @rqzbeh

• fix(client): Absolute fetch("/api/...") and… (#8515) — @rqzbeh

• fix(cli): create ~/.cache (and set XDG_CACHE_HOME)… (#8519)

• fix(api): surface a non-blocking warning + startup scan… (#8530)

• fix(kiro): support profileless Builder ID quota, preserve CLI auth… (#8565) — @nguyenha935

• fix(test): isolate context-manager unit tests on a… (#8568)

• fix(quality): check:file-size --update now removes baseline entries… (#8589) — @MumuTW

• fix(sse): restore Task-Aware Routing config from… (#8604) — @MumuTW

• fix(sse): task-aware routing defaults use auto/* intents… (#8605) — @MumuTW

• fix(providers): keep registered OpenCode Go effort aliases in the… (#8610)

• fix(resilience): report local request-queue expirations as… (#8613)

• fix(docker): Honor OMNIROUTE_BASE_PATH behind reverse-proxy… (#8615) — @DinonowDev

• fix(resilience): recover a wedged local request limiter after an… (#8616)

• fix(providers): Kimi Coding billing-cycle quota errors now recover… (#8632) — @glazec

• fix(oauth): show GitLab Duo OAuth app / env setup instructions in… (#8688)

• fix(sse): combo compression-limit resolution falls back to… (#8716) — @DinonowDev

• fix(db): fall back to Node's built-in SQLite driver when… (#8724) — @epsilonode

• fix(resilience): keep missing request resources such as Files API ids… (#8756) — @wilsonicdev

• fix(api): GET /v1/models no longer rebuilds the whole catalog… (#6408 #8833)

• GHE Copilot: OpenAI-native models now route to <gheUrl>/responses… (#8835) — @hppsc1215

• CLI: omniroute launch no longer truncates pass-through… (#8837) — @sumanxg

• Providers: Codex GPT-5.6 Sol/Terra/Luna report the current… (#8838) — @TitoTFP

• Antigravity: a token refresh now recovers a missing projectId… (#8842) — @HouMinXi

• CI: check:tracked-artifacts raises the git ls-files… (#8844)

• OAuth: ANTIGRAVITY_OAUTH_CLIENT_TYPE=web lets a remote… (#8845) — @HouMinXi

• fix(executors): Vertex AI now routes current-generation Claude models… (#8852) — @wgordon17

• CLI: omniroute launch-codex no longer corrupts the codex… (#8856) — @sumanxg

• Providers: AGY model sync now discovers newly announced chat…

• fix(security): bound JWT-extraction regexes in…

• Fixed every non-streaming Codex (ChatGPT-account) chat…

• Logging: a broken stdout/stderr pipe no longer drives a… (#8181)

• docs: correct three stale references caught by the…

• Fix the Turbopack next build breaking with "Module…

• Fix mitm-dnsConfig unit tests failing when the suite… (#6122)

• muse-spark-web: the WebSocket 401 auth-failure message…

• Harden the Notion web provider thread-session cache…

• fix(security): OIDC login gate now requires…

• Build: the packed tarball boots again — #7191's…

• Packaging: new check:pack-boot gate packs the real npm tarball,…

• Packaging: pack-artifact closure tests now cover EVERY npm-shipped…

• fix(cli): CLI detection now refreshes stale cached results,…

• fix(docker): Podman deployment guidance now distinguishes local… (#8497)

• fix(ui): Theme React Flow controls correctly in dark mode,…

• fix(plugins): the generated plugin host script is now deleted…

• fix(compression): the Headroom SmartCrusher tabular-compaction guard now… — @SingCJ

• Skills: register cli-skill-collector in the agent-skills…

• fix(responses): Make Responses API to Chat Completions downgrades…

• fix(stream): Responses API clients (/v1/responses) no longer… (#4633)

• fix(security): bump adm-zip to ^0.6.0 (dev transitive…

• chore(deps): bump fast-uri≥3.1.3, hono≥4.12.27,…

• chore(deps): bump dompurify≥3.4.12,…

• fix(quality): register the two covering unit tests…

• fix(auth): restore the TICK_MS constant dropped by…

• fix(guardrails/chat): do not whole-request-reroute…

• Providers: yuanbao-web no longer forwards a foreign single cookie…

• Antigravity: the shared token-refresh service now recovers a missing… (#8860) — @HouMinXi

• Adobe Firefly: gpt-image requests now default detailLevel to… (#8863) — @artickc

• Combos: deleting a provider connection now clears the combo… (#8865) — @HouMinXi

• Auto routing: auto/<family> combos (auto/glm, auto/gemini,… (#8866) — @rafaeldrincon

• fix(oauth): wire Test Connection for xAI OAuth (xai-oauth /… (#8862) — @allanvb

• Logs: a failed auto/<family> request no longer writes every… (#8867) — @rafaeldrincon

• fix(usage): correct token/request counting for 30D/90D/YTD/ALL… (#7300) — @growab

• fix(notion-web): use Chrome TLS impersonation for runInferenceTranscript (#8159) — @artickc

• fix(bifrost): send v-prefixed transport version, not bare semver (#8194) — @seanford

• fix(resilience,translator): three release/v3.8.49 base-red regressions + eslint… (#8254)

• fix(sse): export PROVIDER_BREAKER_FAILURE_STATUSES — fix… (#8258)

• fix(providers): limit Gemini CLI to legacy OAuth refresh (#8275) — @backryun

• fix(cli): resolve claude.cmd on Windows in omniroute launch (#8283) — @Dingding-leo

• fix(resilience): skip terminal connections in token health check sweep (#8286) — @Dingding-leo

• fix(sanitizer): strip zero-width chars from Anthropic-native streaming… (#8287) — @Dingding-leo

• fix(i18n): re-sync and complete es-ES translations with latest… (#8289) — @Dragost

• fix(antigravity): add missing gemini-3.6-flash pricing rows to ag OAuth… (#8290) — @HouMinXi

• fix(dashboard): stop sidebar RSC prefetch storms (#8292) — @RaviTharuma

• fix(backend): add structure-aware chat admission (#8296) — @RaviTharuma

• fix(providers): adapt Kimi nonstream requests internally (#8302) — @RaviTharuma

• fix(mcp): keep POST SSE responses uncompressed (#8303) — @RaviTharuma

• fix(api): enforce image generation API key auth (#8306) — @fenix007

• fix(cpa): isolate credential-pool failures (#8308) — @RaviTharuma

• fix(sse): suppress by default on Chat Completions (#8309) — @Prudhvivuda

• fix(translator): cap thinking budget on explicit budget_tokens path (#8312) — @HouMinXi

• fix(providers): classify HTTP 400 model-unavailable as MODEL_NOT_FOUND… (#8319)

• fix(providers): carve cookie-auth providers out of terminal 401… (#8321)

• fix(api): fold namespace into the flattened Chat tool name so… (#8322)

• fix(providers): route noauth opencode-zen connections through their… (#8324)

• fix(security): remove quadratic trailing-slash trim in Alibaba… (#8333)

• fix(memory): self-heal upsertVector/deleteVector from a raced… (#8337) — @hartmark

• fix(sse): stop stripInternalReasoningPlaceholder from eating… (#8341) — @hartmark

• fix(compression): rank codex-responses in adaptive-ladder maps (#8381)

• fix(sse): gate reasoning-placeholder strip to chunks that contain… (#8382)

• fix(resilience): terminal-skip spares the recoverable GitHub Copilot… (#8389)

• fix(sse): re-export PROVIDER_BREAKER_FAILURE_STATUSES for the… (#8390)

• fix(sse): family auto-combos include any backend that serves the… (#8391)

• fix(sse): cap exact cooldowns only when synthetic — verified… (#8393)

• fix(devin-cli): update ACP JSON-RPC protocol for Devin CLI 3000.2.x… (#8425) — @MumuTW

• fix(auth): exclude local CLI providers from tokenHealthCheck… (#8426) — @MumuTW

• fix(oauth): add devin-cli and agy entries to OAUTH_TEST_CONFIG (#8427) — @MumuTW

• fix(dashboard): preserve connection health visual on last routed… (#8428) — @MumuTW

• fix(cursor): bridge native TodoWrite completions (#8432) — @makcimbx

• fix(guardrails): Vision Bridge describe-fallback ignores unreachable… (#8433) — @guhcostan

• fix(sse): record tool calls into shared state for… (#8462) — @hartmark

• fix(oauth): actionable guidance for LAN-origin loopback mismatches… (#8463)

• fix(hyperagent): sticky thread for agentic tool loops (Claude Code) (#8470) — @artickc

• fix: combo input-bound, Responses->Chat image strip,… (#8476) — @herjarsa

• fix(sse): call the real abort-signal helper in the Gemini… (#8485) — @backryun

• fix(providers): honor Extra API Keys rotation in OpencodeExecutor (#8493) — @Prudhvivuda

• fix(backend): fail closed when capability filters empty the combo pool (#8494) — @Prudhvivuda

• fix(providers): resolve native vision for path-shaped multimodal model… (#8495) — @Prudhvivuda

• fix(hyperagent): default 1M context for fable/opus/sonnet (#8496) — @artickc

• fix(notion-web): mint fresh thread for new OpenAI sessions with same… (#8511) — @artickc

• fix(db): classify compressionDetailNormalizers as db-internal in… (#8534) — @MumuTW

• fix(sse): label HTTP 499 disconnects as client_disconnected (#8552) — @DinonowDev

• fix(resilience): honor comboCooldownWait for every combo strategy (#8559) — @DinonowDev

• fix(backend): add error.code to synthOpenAIErrorChunk for guard… (#8570) — @marceli1404

• fix(video): validate Veo AI Free artifacts before success (#8581) — @brunnolouzada

• fix(routing): exclude locked-out models from auto-combo candidates (#8586) — @Prudhvivuda

• fix(api): prevent silent lost updates on concurrent settings… (#8587) — @Prudhvivuda

• fix(auto-combo): short-circuit expandAutoComboCandidatePool when… (#8598) — @mikeiagents

• fix(auth): tag internal/loopback-origin failed logins in the audit… (#8606) — @Prudhvivuda

• fix(providers): declare explicit OpenCode plugin feature-flag defaults (#8608) — @Prudhvivuda

• fix(ci): use webpack fallback for Node 26 compat build to stop… (#8611) — @Prudhvivuda

• fix(claude): classify native subscription quota 429 (#8628) — @costaeder

• fix(windows): request shell when spawning bare qoder binary name on… (#8633) — @Dingding-leo

• fix(middleware): declare withInjectionGuard's context parameter optional (#8644) — @backryun

• fix(providers): handle space-separated search queries via… (#8660) — @maxmad64bis

• fix(dashboard): broken icon allignment in SegmentedControl.tsx (#8679) — @0x2f0

• fix(providers): deprecate Monster API provider (fixes #8676) (#8691) — @Dingding-leo

• fix(quality): register the #8494 covering test in stryker… (#8692)

• fix(sse): clamp max_tokens to the model output cap on every path (#8698)

• fix(executors): pass TimeoutError reason to controller.abort() in 7… (#8699)

• fix(api): serve /v1/models stale-first and sanitize its error… (#8703)

• fix(sse): stop thrashing the provider prompt cache for… (#8705)

• fix: repair five base-red failures on release/v3.8.49 (#8706)

• fix(oauth): show GitLab Duo setup before authorize error (#8710) — @DinonowDev

• fix: hydration mismatch, duplicate React keys, and missing… (#8723) — @Mananz90

• fix(sse): hide synthetic OpenAI startup reasoning (#8729) — @rinseaid

• fix(guardrails): check feature flag helper in PIIMasker to honor DB… (#8730) — @Dingding-leo

• fix(sse): report a stream that completes without any content (#8732) — @backryun

• fix(plugins): delete the generated host script synchronously so… (#8749) — @MumuTW

• fix(sse): update ANTHROPIC_PING heartbeat data payload to… (#8762) — @Dingding-leo

• fix(cloudflare-ai): sync missing free catalog models (fixes #8725) (#8763) — @Dingding-leo

• fix(bedrock): preserve additionalModelRequestFields in converse… (#8764) — @Dingding-leo

• fix(docs): use correct kebab-case CLI flags in OpenCode guide… (#8766) — @swingtempo

• fix(db): repair the extra-migration-dirs test and env contract… (#8773)

• fix(electron): use NEXT_DIST_DIR when stripping stale native modules (#8794) — @NBN-N3

• fix(resilience): add UND_ERR_SOCKET to PROXY_UNREACHABLE_ERROR_CODES (#8795) — @Dingding-leo

• fix(combo): fail open when strict context filter empties… (#8798) — @DinonowDev

• fix(resilience): honor Cloudflare 1010 retryable:false — skip… (#8800) — @DinonowDev

• fix(dashboard): restore Usage Model Breakdown column sorting (#8802) — @DinonowDev

• fix(api): treat cx/* and codex/* as equivalent API-key model… (#8805) — @Prudhvivuda

• fix(sse): pass real response payload into plugin onResponse hooks (#8806) — @Prudhvivuda

• fix(types): export web executor types from their module (#8810) — @backryun

• fix(types): preserve reasoning policy record shapes (#8811) — @backryun

• fix(types): preserve compression detail config shapes (#8812) — @backryun

• fix(types): declare virtual chaos combo config (#8815) — @backryun

• fix(types): type memory skills injection logger (#8816) — @backryun

• fix(types): align web fallback contracts (#8819) — @backryun

• fix(types): declare idempotency input contracts (#8820) — @backryun

• fix(reasoning): sanitize streamed K3 think tags (#8821) — @rinseaid

• fix(types): normalize Kie transcription results (#8824) — @backryun

• fix(dashboard): surface quota pool delete failures instead of failing… (#8829)

• fix(autoCombo): normalize -free suffix in task fitness lookups (#8636) — @Dingding-leo

• fix(sse): split the reasoning-decision guards so the error arm… (#8641) — @backryun

• fix(openai-to-claude): skip empty reasoning_content string deltas (#8642) — @Dingding-leo

• fix(autoCombo): match longest pattern first in lookupStaticFitnessTable (#8651) — @Dingding-leo

• fix(providers): sync search query to URL query param (#8652) — @Dingding-leo

• fix(maritalk): refresh supported model catalog (#8663) — @backryun

• fix(agentSkills): scope command slice before nested subcommands to… (#8667) — @Dingding-leo

• fix(guardrails): ensure request PII masking respects DB feature flag… (#8715) — @Dingding-leo

• fix(reasoning): sanitize Kimi Code K3 think tags (#8721) — @rinseaid

• fix(sse): clamp out-of-range Gemini thinking_budget and learn the… (#8726) — @fuko2935

• fix(providers): support multi-token search in provider filter (#8731) — @Dingding-leo

• fix(api): stop JSON.stringify-ing messages before estimateTokens… (#8740)

• fix(quality): let --update remove baseline entries that already fit… (#8741) — @MumuTW

• fix: escape angle brackets in i18n messages to prevent… (#8747) — @SteeleHu

• fix(dashboard): the /home quick-start cards no longer prefetch — #8292…

• fix(dashboard): Request Logs detail no longer crashes on a structured…

• fix(dashboard): the logs detail modal stops reopening on first close…

📚 Docs

• docs(quality): codify retry policy per runner + release-level drift… (#7107)

• docs(troubleshooting): document Avast/AVG README.md false positive (#7295)

• docs(perf): add per-endpoint p50/p95/p99 latency + cost budget… (#7336) — @KooshaPari

• docs: refresh revoked Discord invite + WhatsApp Brasil link (#7604)

• docs(readme): animated SVG for the 4-tier auto-fallback cascade (#7615)

• docs: sync provider count to 259 (unblocks docs-counts strict… (#7616)

• docs(readme): animate pool + combo ASCII blocks as SMIL SVG diagrams (#7626)

• docs(readme): animate CLI command list + compression flow as SMIL SVGs (#7637)

• docs(readme): replace free-tier budget mockup with animated SMIL card (#7665)

• docs(readme): standardize all README tables to full content width (#7666)

• docs: fix three stale references failing the fabricated-docs… (#7728)

• docs(readme): unified animated card system — audited v3.8.49 numbers,… (#7769)

• docs(readme): add Kimi (Moonshot AI) official supporter section (#7770)

• docs(getting-started): reorder Verify It Works before IDE/CLI setup + add… (#7790) — @swingtempo

• docs(readme): audit every number against the live code + refresh… (#7795)

• docs(readme): evolve supporter section into sub2api-style Sponsors… (#7799)

• docs(readme): contributors 360+ -> 350+ (audited) (#7803)

• docs(i18n): refresh Polish README and fix relative links (#7807) — @leszek3737

• docs: add general Web Cookie provider setup guide (#7881) — @arpit-jaiswal-dev

• docs(guides): document Kaspersky PDM behavioral false positive on the… (#7923)

• docs: document npm install ERESOLVE/peer/deprecated warnings… (#7988) — @Dingding-leo

• docs: fix Docker IPv6 connection reset with -p 127.0.0.1 bind… (#7989) — @Dingding-leo

• docs(readme): Kimi partner tracking links (aff=omniroute) +… (#8028)

• docs: add AgentRouter multi-provider routing troubleshooting (#8049) — @leninejunior

• docs(security): correct prompt-injection severity table +… (#8113) — @rafaumeu

• docs(ops): publish public branching and release model (#8129) — @c4usal

• docs(i18n): full Russian README rewrite (#8217) — @MonteNegroX

• docs(readme): re-audit numbers, fix table scroll, refresh contributors (#8243)

• docs(db): propose pluggable persistence boundary (#8261) — @xiaoyaner0201

• docs(db): add reproducible SQLite coupling inventory (#8262) — @xiaoyaner0201

• docs: add public ROADMAP (3.8.5x rail -> 3.9.0 LTS -> 4.0… (#8348)

• docs: sync env-var contract (chaos panel, notion TLS, grok… (#8362)

• docs: one golden path across PR template, CONTRIBUTING,… (#8380)

• docs(claude-code): document unprefixed model IDs and the Ambiguous model… (#8410) — @dvirarad

• docs(podman): clarify Podman Machine deployment (#8569) — @shixi-li

• docs(env): document NEXT_PUBLIC_OMNIROUTE_BASE_PATH and… (#8690) — @MumuTW

• docs(codex): document session affinity and stream idle for long tasks (#8709) — @DinonowDev

• docs: replace outdated Polish docs with translation from… (#8823) — @leszek3737

• docs: restore the Polish API_REFERENCE removed by #8823 (#8831)

🧪 Tests & Quality

• test(build): derive pack-artifact closures for all npm-shipped… (#7081)

• test(dashboard): dedicated regression guard for #6815 density guarantee (#7291)

• test(ci): make #6634 selfref guard hermetic — read file from… (#7327)

• test(ci): mock route bridge surfaces error message, not raw stack (#7354)

• test(ci): static body in codex e2e mock route bridge (CodeQL #737) (#7558)

• test(ci): exact-line assert in grok-build config test (CodeQL… (#7628)

• test(codex): cover image tool output replay (#7704) — @dongwook-chan

• test(security): exact SAN-entry match in mitm leaf-cert test (CodeQL… (#7824)

• test: verify keepalive interval cleanup on disconnect,… (#8190) — @rafaumeu

• test: realign catalog snapshot tests to current deliberate… (#8386)

• test: hermetic notion thread-session mocks + drop duplicated… (#8392)

• test(e2e): contract test for the full provider journey (#8444) — @HoneyTyagii

• test(sse): repair two base-red gates on release/v3.8.49 (#8490) — @backryun

• test(context): isolate context-manager suite from local DATA_DIR (#8596) — @DinonowDev

🔧 Chores / CI

• chore(release): gate the sync-back push on release-green --quick (WS0.3) (#7083)

• chore(ci): gate hygiene — secrets baseline 0, semgrep drop,… (#7099)

• chore(ops): runner-box janitor + operations runbook (WS3.3) (#7115)

• chore(ci): promote test:vitest:ui to blocking (suite green after… (#7147)

• chore(ci): stop dependabot proposing typescript majors —… (#7306)

• chore(release): script the 0a.0b PR re-home with a verified read-back (#7312)

• chore(quality): tighten the coverage ratchet to the CI's real numbers (#7326)

• chore(ci): make the Electron Windows leg advisory with bash stderr… (#7340)

• chore(deps): bump actions/setup-node from 6 to 7 (#7348)

• chore(deps): bump codecov/codecov-action (#7350)

• ci(release-green): add a main-green arm to detect when main goes red (#7355)

• chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.1 (#7641)

• chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.1 (#7642)

• chore(quality): register #6672 test in stryker tap.testFiles (base-red… (#7652)

• chore(release): merge-train box-speed suite + --fast mode (#7670)

• chore: [defer] fix embedded CLIProxyAPI config handling (#6877) — @professional-ALFIE

• chore: [defer] fix(grok): align responses tool-call shape for… (#6937) — @CitrusIce

• chore: [needs-vps] feat(dashboard): add per-operator quota row… (#7251)

• chore: [defer] feat(combo): universal cooldown-aware retry &… (#7301) — @ViFigueiredo

• chore: Completing Arabic language (#7686) — @mustafa-phd

• chore: IC2: Cache provider connections by ID + provider nodes (#7744) — @oyi77

• chore: [Emergency Fix] fix(build): repair release build… (#7772) — @backryun

• chore: [Part 1/3]refactor(qwen): replace legacy Qwen Code and… (#7866) — @backryun

• chore: [Part 3/3] feat(qwen): add regional Alibaba and Qwen… (#7882) — @backryun

• chore: Preserve supported Responses behavior in Chat… (#7894) — @JxnLexn

• chore: Restore Responses API custom tool calls (#7905) — @JxnLexn

• chore: Hide internal reasoning replay placeholders (#7912) — @JxnLexn

• chore(deps): bump js-yaml, brace-expansion, shell-quote, tar… (#7915)

• chore: i18n(zh-TW): complete Traditional Chinese (Taiwan)… (#8024) — @lunkerchen

• chore: i18n: bring 40 locales to full parity with en.json (#8031) — @nguyenha935

• chore(deps): resolve 7 open Dependabot alerts via npm overrides (#8066)

• chore(deps): resolve 3 more Dependabot alerts (dompurify,… (#8069)

• chore(dashboard): reframe Kimi partnership as "Open Source Friends" (#8117)

• chore(quality): fix 2 pre-existing lint/suppression drift issues (#8209) — @hartmark

• chore: add K3banner-1.png banner asset (#8242)

• chore(quality): rebaseline accountFallback+combo for #8252 own-growth… (#8252) — @RaviTharuma

• optimize(chaos+ponytail): i18n ponytail, dedupl dispatch, provider diversity (#8264) — @Moseyuh333

• chore(deps): bump next to 16.2.11 (9 security advisories) (#8265)

• chore: Add Alibaba-family media model support (#8266) — @backryun

• chore: Clicking a provider card hitting back loses scroll… (#8349) — @swingtempo

• chore: feat(log): Added new visual scrolling log page (#8354) — @hartmark

• chore: [BUG] enforceOutputTokenBudget ignores combo-resolved… (#8378) — @RCrushMe

• chore(ci): cancel superseded runs, skip DAST on docs-only PRs,… (#8379)

• chore(quality): drop stale muse-spark-web allowlist entry + sync… (#8383)

• chore: i18n(zh-TW): translate missing Reasoning Routing strings (#8423) — @MumuTW

• chore(deps): bump codecov/codecov-action from 5.5.5 to 7.0.0 (#8452)

• chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.3 (#8453)

• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#8454)

• chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.3 (#8455)

• chore(deps): bump actions/setup-python from 6 to 7 (#8456)

• chore(sse): drop deprecated baseUrl from open-sse tsconfig for TS… (#8473) — @backryun

• refactor(sse): resolve open-sse utils/translator type diagnostics for… (#8483) — @backryun

• refactor(sse): declare the executor execute() result contract (#8489) — @backryun

• refactor(sse): stop three executors shadowing BaseExecutor.buildHeaders (#8498) — @backryun

• refactor(sse): narrow three result unions via type predicates (#8499) — @backryun

• refactor(sse): restore three executor types the runtime already relied… (#8520) — @backryun

• refactor(dashboard): clear file-size base-red by extracting provider-card… (#8524) — @MumuTW

• refactor(guardrails): narrow the documented void return at the dispatch site (#8525) — @backryun

• refactor(sse): type the rerank response adapter's options parameter (#8528) — @backryun

• refactor(sse): retag the designer-web result unions with string… (#8531) — @backryun

• refactor(sse): declare the multipart/gRPC frame bodies as… (#8533) — @backryun

• chore(ci): resync stale no-explicit-any suppression count for… (#8544) — @MumuTW

• chore(usage): decompose services/usage.ts into per-provider usage/*… (#8545) — @MumuTW

• chore(validation): decompose providers/validation.ts into validation/*… (#8546) — @MumuTW

• chore(token-refresh): decompose services/tokenRefresh.ts into tokenRefresh/*… (#8547) — @MumuTW

• chore(combo): extract pure error predicates and quota status helpers… (#8548) — @MumuTW

• chore(i18n): normalize zh-TW terminology and sync stale README… (#8554) — @MumuTW

• refactor(sse): stop isClaudeEventPayload claiming a narrowing it never… (#8557) — @backryun

• chore(quality): rebaseline file-size for inherited base growth (#8561) — @fenix007

• chore(deps): patch js-yaml + postcss for 2 high Dependabot alerts (#8572)

• refactor(tls): update TLSClient instantiation to use… (#8583) — @DinonowDev

• refactor(sse): peel the bare Response off handleChatCore's union in… (#8647) — @backryun

• refactor(sse): guard the KIE task-id and callback-url reads at their… (#8661) — @backryun

• refactor(sse): declare the ArrayBuffer backing on media byte producers (#8665) — @backryun

• merge: resolve conflicts for #7904 local corpus context… (#8685) — @terrafirmbot-source

• chore(quality): update baselines after v3.8.49 merge-train (#8686)

• chore: Dependabot updates (#8695) — @justdoGIT

• chore: Create AMIT (#8727) — @amitgolan60-coder

• chore(ci): add release PR build gate (#8735) — @ekinnee

• chore: Stabilize Notion web sessions and JSON output (#8751) — @0xheycat

• deps: bump electron from 43.1.1 to 43.2.0 in /electron (#8782)

• deps: bump the production group across 1 directory with 18… (#8793)

• refactor(sse): retag the Adobe Firefly IMS token-check union (#8638) — @backryun

• refactor(db): let the provider-nodes cache keep the row type it… (#8639) — @backryun

• refactor(sse): use the shared ApiKeyMetadata in reasoningRouting… (#8643) — @backryun

• refactor(sse): narrow three media-generation result unions (#8645) — @backryun

• refactor(sse): declare the semantic-cache read path's parameters (#8646) — @backryun

🔀 Other

• [needs-vps] fix(electron): materialize Turbopack… (#6794) — @huohua-dev

• [codex] Keep mode-pack weights consistent in auto… (#7008) — @KooshaPari

• Explain effective auto-combo scoring weights (#7087) — @KooshaPari

• [needs-vps] fix(dashboard): add vision-capability… (#7124)

• [needs-vps] fix(dashboard): align onboarding tier… (#7125) — @Wibias

• Use OpenAI chunks for early chat keepalives (#7136) — @KooshaPari

• Fix Codex Responses compression analytics (#7273) — @JxnLexn

• Add cache-aligned Live Zone compression (#7280) — @JxnLexn

• Fix routed target request parameters (#7323) — @JxnLexn

• deps: bump electron from 43.1.0 to 43.1.1 in /electron (#7349)

• deps: bump the development group with 8 updates (#7351)

• deps: bump the production group across 1 directory with… (#7352)

• Add per-connection Provider Quota visibility (#7360) — @JxnLexn

• Stream model health probes for slow providers (#7377) — @JxnLexn

• Refresh NVIDIA free metadata and detect catalog drift (#7378) — @JxnLexn

• Reject invalid output token budgets (#7379) — @JxnLexn

• Honor provider proxies for The Old LLM Vercel blocks (#7380) — @JxnLexn

• Restore proxy navigation and sidebar accordion state (#7381) — @JxnLexn

• Expose proxy controls for no-auth providers (#7419) — @JxnLexn

• Add reasoning-based model and effort routing (#7607) — @JxnLexn

• refactor(sse): extract per-provider token-refresh functions from… (#7817)

• deps: bump the production group with 8 updates [bot] (#7897) — @dependabot

• deps: bump the development group with 5 updates [bot] (#7898) — @dependabot

• refactor(antigravity): align official clients and callable catalog (#8013) — @backryun

• refactor(compression): extract resolveHeadroomDetail to keep… (#8058)

• deps: bump next from 16.2.10 to 16.2.11 [bot] (#8235) — @dependabot

🩹 Direct release-branch fixes (no PR — authorized base-red sweep, 2026-07-18)

• fix(base-red): full-suite realignment after the 102-PR merge campaign:…
• chore(release-branch): cycle maintenance pushed directly to release/v3.8.49…
• test(ui): the vitest:ui suite was red across the whole cycle…

📝 Maintenance

• Merge-train script: (scripts/release/merge-train.sh): batch-validates N… (#6784)
• release: list-uncovered-commits.mjs now unions the CHANGELOG… (#6857 #6878)
• chore(ci): stop dependabot from proposing typescript majors —…
• maintenance(quality): re-baseline file-size for two legitimately-grown…
• fix(i18n): backfill the four usage.* quota-visibility keys #7251…
• docs(codex): document session affinity (sessionAffinityTtlMs) and… (#7287)
• test(dashboard): restore dedicated regression coverage for #6815's… (#7291)
• Antivirus false-positive note: (docs/guides/TROUBLESHOOTING.md): documents why…
• chore(release): add scripts/release/rehome-open-prs.mjs — the Phase… (#7307)
• Add an advisory production build to the PR-to-release…
• docs: Add docs/INCIDENT_RESPONSE.md — a non-security… (#7334) — @KooshaPari
• docs: Add docs/PERF_BUDGETS.md — per-endpoint p50/p95/p99… (#7336) — @KooshaPari
• README tier-cascade diagram animated: (docs/diagrams/tier-cascade.svg): the ASCII 4-tier… (#7615)
• Docs provider-count sync: (README.md, AGENTS.md, CLAUDE.md): provider-count… (#7616)
• README animated diagrams: (docs/diagrams/pool-fair-share.svg,… (#7615)
• docs(ops): publish public branching/release model (release/* =… (#7627) — @c4usal
• README animated diagrams, round 3: (docs/diagrams/cli-terminal.svg,…
• README: replaced the free-tier budget preview mockup… (#7665)
• README: standardized all 28 tables to the same full… (#7666)
• Realigned 13 test files that had drifted red on the… (#7690)
• README: unified animated card system — numbers audited… (#7769)
• chore(quality): fix two release-tip base-reds blocking every fresh PR…
• fix(i18n): backfill the six providers.tierOverride* keys #7838…
• chore(quality): regenerate the provider translate-path golden snapshot…
• chore(quality): prune a stale ESLint suppression for…
• Extract resolveHeadroomDetail() from the…
• chore(quality): rebaseline complexity (2130→2183) and… (#3501 #8566) — @MisileLab
• refactor(sse): extract combo dispatch prelude… (#8582) — @MumuTW
• chore(quality): bank completed file-size shrinks into… (#8585) — @MumuTW
• refactor(sse): extract combo target resolution into… (#8592) — @MumuTW
• Source-scanner negative guards: (tests/unit/source-scanner-guards.test.ts): hard gate… (#8619) — @MumuTW
• chore(skills): regenerate skills/cli-backup-sync/SKILL.md so it… (#8657) — @MumuTW
• chore(quality): extract pure provider input parsers to…
• Realign the Antigravity non-streaming 429-retry test…
• chore(quality): restore no-explicit-any severity to…
• chore(base): pt-BR/en i18n keys for #6909…
• chore(base): re-export relayProbeStats from localDb…
• fix(tests): realign the disabled-compression combo…
• CI: pr-test-policy fetches the base branch with full…
• ci: unit fast-path sharding doubled 2→4 (halves the… (#6781 #6691 #6693)
• CI: Codecov patch-coverage on every PR diff (informational…
• Classify upstream dispatches by host instead of URL…
• chore(combo): extract 8 pure error predicates and quota status…
• CI: raise the Coverage job timeout 10→20min — the lcov… (#7114)
• CI: raise the dast-smoke job timeout 12→25min — the CLI…
• chore(validation): decompose…
• chore(token-refresh): decompose…
• chore(usage): decompose open-sse/services/usage.ts…
• docs: routing-strategy count reconciled to 18 across… (#6663) — @chirag127
• CI: E2E matrix shards are now duration-balanced (LPT…
• CI: the new Electron Windows prepare-bundle leg (WS1.5) is…
• CI: the Electron Package Smoke job now runs a Windows leg…
• Quality gates hygiene (WS6/D3 + WS1.7): gitleaks baseline zeroed — the 3 frozen…
• fix(oauth): register ghe-copilot in the OAuth…
• fix(dashboard): add the ghe-copilot entry to the…
• chore(perf): add npm run bench:heap-body — a…
• CI: hotfix fast-lane — PRs labeled hotfix (owner-applied,…
• chore(ci): resync the stale no-explicit-any…
• chore(release): merge-train runs the box-tuned…
• chore(release): merge-train --fast now classifies changed tests with…
• CI: quality.yml draft guards now also match Mergify…
• Merge queue (D5): reviewed PRs now merge through the Mergify queue…
• Release: npm publishing is now STAGED by default — the workflow…
• chore(release): v3.8.47 pre-flight — relocate #6943…
• Docs: QUALITY_GATES.md now codifies the per-runner test…
• chore(quality): owner-approved ratchet rebaseline for…
• docs(readme): fix stale counts — 18 routing strategies (adds the…
• Rebaseline the cyclomatic-complexity ceiling (2059 →…
• CI: release-green validation is now continuous — every code…
• chore(ci): fix two shared base-reds on the release tip that…
• docs: refresh llm.txt to the current project state (248…
• Strengthen the compareRouterEvalRuns regression test…
• Ops: scripts/ops/runner-janitor.sh +…
• chore(security): scrub hardcoded live-instance credentials (API key +…
• Tests: the #6634 self-reference test now fetches origin/main…
• Register 5 covering unit tests (account-fallback…
• chore(quality): register microsoft-designer-web-6672…
• Release tooling: sync-next-cycle.mjs now runs `validate-release-green…
• Rebaseline testFrozen for…
• chore(quality): tighten the coverage ratchet to the CI's real numbers…
• chore(quality): split open-sse/services/tokenRefresh.ts (2249 lines,…
• chore(quality): re-pin the file-size ceilings touched…
• chore(quality): re-pin the chatCore.ts file-size…
• chore(quality): align the pack-artifact expected-path…
• chore(quality): re-pin the apiKeys.ts and…
• CI: Playwright E2E and both vitest suites now emit JUnit…
• CI: the fast-path Vitest job (every PR) now also emits…
• CI: TypeScript 7 (native compiler, GA 2026-07-08) now runs…
• maintenance(quality): clear v3.8.49 owner-PR-campaign base-reds on…
• Release tooling: new scripts/release/verify-published.mjs <version> —…
• CI: promote test:vitest:ui to a blocking gate — the suite… (#7127)
• chore(tests): fix all 70 failing test:vitest:ui tests…

🙌 Contributors

Contributor	PRs / Issues
@0x2f0	#8679
@0xheycat	#8751
@adevwithpurpose	#8123
@adrianaryaputra	#7928
@advane204f	direct commit / report
@Ajeesh25353646	#7528
@allanvb	#8471, #8759, #8814, #8862
@alltomatos	#6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821, #7041, #7042, #7164, #7277, #7490, #7492, #7644
@alvaretto	#8077, #8161, #8170
@amitgolan60-coder	#8727
@andrea-kingautomation	#7678
@andrewmunsell	#6774, #6779, #6795
@AndrianBalanescu	#6828, #6829, #7794, #7804, #7810, #7813, #7816, #7891, #8050
@anhdiepmmk	direct commit / report
@anndev-69	direct commit / report
@apoapostolov	#8127
@arpit-jaiswal-dev	#7881
@artickc	#6763, #6955, #7204, #7696, #7768, #7896, #7900, #7911, #7930, #7994, #8006, #8159, #8470, #8496, #8511, #8863
@Arul-	#7878
@asynx6	direct commit / report
@attid	#6984
@backryun	#6280, #6675, #6862, #7296, #7314, #7358, #7531, #7687, #7772, #7812, #7866, #7874, #7882, #7914, #8013, #8225, #8226, #8227, #8230, #8266, #8275, #8298, #8464, #8473, #8483, #8485, #8489, #8490, #8498, #8499, #8520, #8525, #8528, #8531, #8533, #8557, #8638, #8639, #8641, #8643, #8644, #8645, #8646, #8647, #8661, #8663, #8665, #8732, #8810, #8811, #8812, #8815, #8816, #8819, #8820, #8824
@beingshafin	direct commit / report
@brick30llc-ctrl	#6944
@brunnolouzada	#8581
@c4usal	#7627, #8129
@CahyokPutraDev99	direct commit / report
@Capslockb	#7892
@CarmeloCampos	direct commit / report
@Chewji9875	#7545
@chirag127	#6022, #6593, #6643, #6644, #6646, #6650, #6769, #6771, #6804, #7079, #7520, #8143
@chitholian	direct commit / report
@chy1211	direct commit / report
@CitrusIce	#6937, #6938
@costaeder	#8628
@Dan-ex-hub	#7743
@danscMax	#7359, #7511, #7517, #7648, #7656, #7672, #7689
@dependabot	#7897, #7898, #8235
@Dingding-leo	#7988, #7989, #8162, #8165, #8167, #8283, #8286, #8287, #8633, #8636, #8642, #8651, #8652, #8667, #8691, #8715, #8730, #8731, #8762, #8763, #8764, #8795
@DinonowDev	#8552, #8559, #8583, #8596, #8615, #8709, #8710, #8716, #8798, #8800, #8802
@dionisius95	direct commit / report
@DKotsyuba	#7500
@dongwook-chan	#7574, #7582, #7704
@Dragost	#8289
@Duongkhanhtool	direct commit / report
@dvirarad	#8410
@ekinnee	#7601, #7613, #7614, #7662, #7779, #7927, #7932, #7980, #8735
@enjoyer-hub	#6647, #7863
@epsilonode	#8724
@evinjohnn	direct commit / report
@fajarbossit	direct commit / report
@felipeleite	direct commit / report
@fenix007	#7171, #7399, #8306, #8561
@FenjuFu	#7942
@floze-the-genius	#7707
@fontvu	direct commit / report
@fuko2935	#8726
@fzrilsh	direct commit / report
@gitcommit90	#6986
@glazec	#8632
@growab	#7062, #7300
@guanbear	#7028
@guhcostan	#8433
@hartmark	#8208, #8209, #8210, #8211, #8212, #8213, #8337, #8341, #8354, #8462
@HassiyYT	#7864
@heishen6	direct commit / report
@herjarsa	#7612, #7625, #7633, #7869, #7871, #8476
@HoneyTyagii	#8444
@HouMinXi	#7035, #7129, #7290, #7398, #7408, #7973, #8290, #8312, #8842, #8845, #8860, #8865
@hppsc1215	#7546, #8835
@huohua-dev	#6794
@hydraxman	#7909
@iamraydoan	#6798
@ianriizky	#6072, #6538
@ikelvingo	#8355
@insoln	#7906, #7908, #8041, #8054, #8062
@irvandikky	#7695
@isiahw1	#7555
@itiwant	direct commit / report
@janeza2	#6308
@Jordannst	direct commit / report
@JoshimOfficial	#8526
@justdoGIT	#8695
@JxnLexn	#6776, #6993, #7154, #7177, #7269, #7273, #7280, #7281, #7282, #7323, #7360, #7377, #7378, #7379, #7380, #7381, #7419, #7607, #7894, #7905, #7912, #8008, #8009, #8010
@kamenkadmitry	#7350, #7425
@kaon0388v1	#7049
@KaynXu	#8284
@KooshaPari	#6611, #6632, #6856, #7008, #7087, #7093, #7128, #7130, #7136, #7315, #7318, #7334, #7336
@KunN-21	direct commit / report
@leninejunior	#8049
@leszek3737	#7782, #7807, #8343, #8543, #8823
@like3213934360-lab	direct commit / report
@linhdmn	#8439
@Long-Feeds	#8011
@loulanyue	#7540
@lucasjustinudin	direct commit / report
@lunkerchen	#8024
@makcimbx	#7692, #8171, #8432
@Mananz90	#8723
@marceli1404	#8570
@maxmad64bis	#8660
@megamen32	#7313
@MichaelYcJo	#8224
@mikeiagents	#8598
@MikeTuev	#6586
@mikolaj92	#6973
@MisileLab	#8566
@MonteNegroX	#8217
@Moseyuh333	#7781, #8264
@MrFadiAi	#7073
@mrprohack	direct commit / report
@MumuTW	#8423, #8425, #8426, #8427, #8428, #8524, #8534, #8544, #8545, #8546, #8547, #8548, #8554, #8582, #8585, #8589, #8592, #8604, #8605, #8612, #8619, #8657, #8690, #8741, #8749
@mustafa-phd	#7686
@NBN-N3	#8794
@nguyenha935	#7493, #7547, #7552, #7553, #7629, #7935, #8031, #8098, #8233, #8565
@nguyenphi37	direct commit / report
@not-knope	#8206
@nramabad	#7926
@oyi77	#6917, #6918, #6919, #6920, #6921, #6923, #7032, #7045, #7046, #7066, #7070, #7178, #7719, #7744, #7787, #7893, #8219
@Pitchfork-and-Torch	#6747, #6791
@professional-ALFIE	#6877
@Prudhvivuda	#8032, #8220, #8250, #8309, #8441, #8467, #8488, #8493, #8494, #8495, #8586, #8587, #8606, #8607, #8608, #8611, #8805, #8806
@QRcode1337	#7034
@quanturbo	#6780
@rafaeldrincon	#8866, #8867
@rafaumeu	#6813, #6979, #6982, #6983, #6987, #6988, #7001, #7808, #7815, #8071, #8113, #8179, #8184, #8185, #8190, #8195, #8196, #8203
@RaviTharuma	#7852, #7853, #7855, #7862, #7885, #7972, #7978, #8021, #8022, #8023, #8025, #8027, #8030, #8101, #8102, #8124, #8252, #8292, #8296, #8301, #8302, #8303, #8304, #8308
@RCrushMe	#8151, #8378
@ricatix	direct commit / report
@ridho9	#8310
@rinseaid	#8721, #8729, #8821
@rixzkiye	direct commit / report
@rqzbeh	#8514, #8515
@rushsinging	#7256
@ryanngit	direct commit / report
@samir-abis	direct commit / report
@seanford	#8194, #8218, #8232
@SeaXen	#7063, #7264, #7294
@Securiteru	#7683
@SemonCat	direct commit / report
@shixi-li	#8569
@SingCJ	direct commit / report
@skutanjir	#7865, #7939
@spacesky-cell	direct commit / report
@SteeleHu	#8747
@sumanxg	#8837, #8856
@swingtempo	#7790, #8349, #8766
@Tasogarre	#7861, #8207
@techsolutionmta	direct commit / report
@tenshiak	#7274, #7643
@terrafirmbot-source	#8685
@thepigdestroyer	#7497
@tianrking	#7353
@tientien17	#7841, #7844, #7925
@TitoTFP	#8838
@tjengbudi	#4009
@tmone	#7806, #7933
@TrackCrewGalore	#6271, #8128
@trfi	direct commit / report
@TuyulSpam	direct commit / report
@ViFigueiredo	#7301
@vzts	#7390
@warelik	direct commit / report
@way-art	direct commit / report
@webmasterarbez	#7504
@wgordon17	#8852
@whale9820	direct commit / report
@Wibias	#7125
@wilsonicdev	direct commit / report
@Witroch4	#6753, #6762, #6790, #7901, #7902
@XCrag	direct commit / report
@xiaoyaner0201	#8122, #8261, #8262
@xier2012	#7036, #7050, #7052, #7053, #7056, #7059, #7060, #7061, #7166, #7299
@xxue-z	#7098
@xz-dev	#6323, #6330, #6714, #6727, #7004, #7012, #7027, #7673, #7700, #7747, #7776, #7843
@yidecode	direct commit / report
@yinaoxiong	#6805
@diegosouzapw	maintainer