0.6.5-Hotifx

fix(tdz): move totalLatency declaration before saveUsageStats call in nonStreamingHandler
ReferenceError: Cannot access 'totalLatency' before initialization
at nonStreamingHandler.js:250 — totalLatency was declared at line 298 but
referenced at line 250 (TDZ: const not yet initialized). Moved the declaration
above the saveUsageStats call. This was the root cause of the chat-completions
500 error on all providers (test model + chat).

Full Changelog: 0.6.4...0.6.5-Hotfix

0.6.4 - Redesign and added new Cookies Provider

feat(v0.6.4): Kiro sonnet-5, providers UX, OAuth providers + Usage page total redesign
KIRO PROVIDER

• Add claude-sonnet-5 to Kiro model catalog with capability metadata
  (contextLength: 1M, maxOutputTokens: 128K) — matches OmniRoute registry;
  all Claude 5/4.5/Haiku variants (base/thinking/agentic) enriched.

PROVIDERS PAGE UX

• Collapsible dropdowns: all 5 provider sections (Custom, Cookies, OAuth,
  Free Tier, API Key) now toggle open/closed with chevron + count badge.
  Custom + Cookies default collapsed; others expanded.

NEW COOKIE PROVIDERS (4)

• HuggingChat (24 models, hf-chat cookie), LMArena (11 models, session cookie),
  Puter (34 models, puter_auth_token), Pollinations (31 models, no-auth).
  Each: registry + executor + validation/test probes. Total cookie providers: 24.

NEW OAUTH PROVIDERS (3) + BRAND ICONS

• Cody (Sourcegraph): OpenAI-compatible, sgp_ token, free plan (~200 msg/mo).
• Trae (ByteDance): session-based SOLO agent, Cloud-IDE-JWT (~14d), custom executor.
• Windsurf: registry + full catalog (Claude Opus 4.7 tiers) + "Coming Soon" badge
  (gRPC-web adapter pending); icon shows but chat deferred.
• 3 hand-crafted SVG brand icons (Windsurf wave, Trae "T", Cody "C" + graph nodes);
  ProviderIcon loader now picks .svg vs .png per provider.

USAGE PAGE — TOTAL REDESIGN

Data layer:

• usageHistory gains latencyTtftMs/latencyTotalMs columns + status index
  (additive schema migration, auto-sync).
• Latency populated end-to-end (saveUsageStats → handlers → INSERT).
• getUsageStats now returns statusCounts + errorRate + latency{avg,p50,p95}.
• 3 new chart aggregations: getStackedChartData, getLatencyChartData,
  getErrorChartData. /chart route dispatches by ?view=. /providers uses
  SELECT DISTINCT. /request-logs returns structured JSON.
  UI (5 new chart components + Overview broken into 9 components + Logs tab):
• Sparkline, DonutChart, StackedAreaChart, LatencyChart, ErrorRateChart
  (all token-driven, recharts/hand-rolled SVG).
• Overview: hero KPI row w/ sparklines (Cache Saved re-enabled), live activity
  strip, error donut, stacked provider chart, latency chart, breakdown table,
  topology. Dead UsageStats (531 lines) replaced.
• Logs tab: real-time SSE streaming request log (replaces dead RequestLogger).
• Details tab: design-system aligned (border-black → border-border-subtle).
  Cleanup:
• Deleted RequestLogger, UsageStats, UsageChart, OverviewCards (dead).
• Moved ProviderLimits usage/components/ → quota/components/ (correct home).
• Page renamed "Activity" → "Usage"; period "All" exposed.

META

• bump version 0.6.3 → 0.6.4 (package.json, cli/package.json)

0.6.3-Hotfix

fix(v0.6.3): cookie provider authType, Cline envelope, provider dropdowns, navbar, support popup
BUG FIXES

• fix(cookies): provider cards showed "No Connections" despite a saved cookie. POST
  /api/providers persists web-cookie connections with authType "cookie", but the main
  providers page queried stats by authType "apikey" → 0 matches. Fixed the 3 call sites
  (sort, card stats, toggle) to query "cookie" (page.js). Added a "cookie" mode branch to
  /api/providers/test-batch so the "Test All" button on the Cookies Provider section works.
• fix(cline): "Provider returned no completion choices for this model" on the model Test
  button. Cline/ClinePass wrap non-streaming responses in a { data: { choices: [...] } }
  envelope while SSE chunks are flat, so ping's parsed.choices check saw nothing.
  • Unwrap the envelope in handleNonStreamingResponse (covers non-stream chat too).
  • ping.js now also checks parsed.data.choices and accepts reasoning-only responses
    (thinking models spend the tiny probe budget on reasoning_content before any content).
• fix(navbar): tighten Sidebar isActive — exact match + segment-boundary match so highlight
  is never ambiguous. Root cause of the reported "stale" symptom was the loose startsWith.

UI/UX

• Providers page: "Custom Providers" and "Cookies Provider" sections are now collapsible
  dropdowns (default collapsed) with a chevron + count badge — the page no longer dumps
  20+ cookie providers at once.
• Support/Donation popup: added a "Support" button to the sidebar footer. Rewrote
  DonateModal to be self-contained with hardcoded channels (PayPal, Ko-fi, Saweria/APAC)
  and their QR codes — no remote fetch, works offline, no 404.

META

• bump version 0.6.2 → 0.6.3 (package.json, cli/package.json)

0.6.2

feat(v0.6.2): Hierarchical Swarm, reliability layer, 20 cookies providers, Devin, UX fixes
NEW FEATURES

Reliability & Security

• Circuit Breaker: per-provider CLOSED/OPEN/HALF_OPEN state machine that auto-skips
  failing upstreams and probes with HALF_OPEN to auto-recover (open-sse/services/circuitBreaker.js)
• Health Monitor: in-memory sliding window per provider + SSE feed + live dashboard
  (open-sse/services/healthMonitor.js, /api/health/stream, dashboard Health page)
• Per-Key Model Access Control (ACL): allowedModels allow-list on each API key; requests
  using a scoped key are rejected (403) up-front if the model isn't in the list
  (schema allowedModels column, apiKeysRepo, keys API, chat.js ACL check)

Multi-Agent Orchestration

• Hierarchical Swarm Engine combo strategy: Manager → Staff → Workers (parallel) → Audit →
  Synthesis, with Smart Gatekeeper triage and persona-bleed protection
  (open-sse/services/swarm.js, combos/page.js, /api/usage/stream telemetry, dashboard Swarm page)

New Providers

• Devin CLI: session-based adapter for the Devin (Cognition) API; bridges session create →
  poll → OpenAI SSE synth. Models map to agent modes (devin-normal/fast/lite/ultra). API-key only.
  (registry/devin.js, executors/devin.js)
• ChatGLM (Web): cookie-based reverse of chatglm.cn consumer web chat with token refresh +
  SSE translation (registry/chatglm-cn.js, executors/chatglm-cn.js)
• 17 web-cookie providers ported from OmniRoute (fetch-based, anti-bot providers included
  best-effort): deepseek-web, qwen-web, kimi-web, blackbox-web, t3-web, duckduckgo-web,
  venice-web, doubao-web, v0-vercel-web, poe-web, copilot-web, muse-spark-web, adapta-web,
  veoaifree-web, claude-web, chatgpt-web, gemini-web (registry + executors for each)

UI/UX

• "Cookies Provider" section on the Providers page (above OAuth) — uncomments + repositions
  the previously dead Web Cookie section; renders all 20 cookie providers with a cookie
  textarea input and Test All button
• Model search box + "Test All (N)" button on every provider's Available Models section;
  Test All is scoped to visible (search-filtered) models and runs concurrently
• Provider card dot labels/colors now include a "Cookie" category (purple)
• Validation + Test probes for all 17 new web-cookie providers (validate/route.js,
  testUtils.js) — cookie parsing, WAF detection, anti-bot-aware messaging

CHANGES & FIXES

• fix(cline): Cline 401 "Cannot read properties of undefined (reading 'toString')" —
  refreshUrl was only in the oauth block and not injected to the flattened config by
  buildTransport(), so PROVIDERS.cline.refreshUrl was undefined and crashed proxyAwareFetch.
  Added tokenUrl + refreshUrl to cline registry transport to match clinepass.
• fix(proxyFetch): harden proxyAwareFetch against undefined/null url with a clear error
  message instead of the cryptic toString() crash
• fix(clinepass): resolve 401 on ClinePass models — workos: prefix was wrongly applied to
  API keys; improved isApiKey detection in clineAuth.js (JWT vs long opaque key vs prefix)
• fix(ui): duplicate dropdown chevron in the Select component — native browser arrow was
  not hidden; added appearance-none + vendor prefixes (fixes "API Type" double-arrow)
• fix(devin): executor now resolves agent mode via PROVIDER_MODELS instead of the flattened
  PROVIDERS.devin.models (which doesn't carry models after buildTransport)
• fix(copilot-web): optional ws dynamic import marked webpackIgnore to avoid bundler
  "Module not found" warning (native WebSocket fallback retained)

META

• README: removed the 9router-era Video Guides section; added feature rows + detail
  sections for Swarm, Health Monitor, Circuit Breaker, Per-Key ACL, Cookies Providers,
  Devin, and Model Test All
• bump version 0.6.1 → 0.6.2 (package.json, cli/package.json); dashboard version badge
  reads dynamically from package.json