Release v0.1.5

What's Changed

🚀 New Features & Enhancements

• Coding Agent Telemetry & Detection:
  • Track and persist client User-Agent across all gateway completion requests (@srouter/types, @srouter/db, apps/api).
  • Dedicated automatic detection for known coding agents and CLI tools: OpenCode, Claude Code, Cursor, Cline, Roo Code, Codex, Aider, Hermes, AGY / Antigravity, and Continue.dev.
• Analytics Overhaul:
  • Added unified Breakdown & Distribution Tabs covering Models, Agents, and Providers in a clean, non-cluttered responsive view.
  • Added authentic brand icons for coding agents and provider targets.
• Redesigned Request Audit Logs:
  • Minimalist, cleaner table layout: merged Client IP under Timestamp, unified Model + Provider routing.
  • Replaced side sheet with a centered, structured Log Detail Modal Dialog.
  • Replaced bulky Raw JSON display with clean structured metadata, moving raw payloads into an optional collapsible section.
• Settings & Security Polish:
  • Redesigned Admin Password management panel with a dedicated 3-column input grid, clear labels, and show/hide toggle.
  • Fixed duplicate version display prefix (vv...) in settings header.
  • Added dynamic status badge for Bearer Authentication (Enforced vs Permissive).
• Multi-Account & Quota Management:
  • Multi-account round-robin load balancing across provider connections (#82).
  • Render clean per-account quota sections inside unified provider cards.
• Pricing & Vision:
  • Support loading model pricing dynamically from models.jsonc.
  • Added vision/multimodal support to Antigravity and OpenCode adapters.
• Database & Deployment Flexibility:
  • Full PostgreSQL support via DATABASE_URL with dual-driver support alongside SQLite (#83).
  • TLS support for Heroku Postgres (#89).
  • Support for single-port OAuth deployments via SROUTER_PUBLIC_URL.

🐛 Bug Fixes

• Claude Code v2 Compatibility: Support for system role normalization, adaptive thinking headers, and unknown model warnings (#92).
• Provider Alias Routing: Resolved custom provider aliases to UUID-backed executors (#90, #95).
• Postgres Compatibility: Quoted camelCase aliases, coerced BIGINT aggregates to numeric values, and fixed integer overflow in timestamps (#94).
• API Error Codes: Ensured typed ToContentfulStatusCode helper is used across API responses (#93).

🔄 Pull Requests Included

• #82: feat(providers): real round-robin load balancing across multi-account connections
• #83: feat(db): add PostgreSQL support via DATABASE_URL with async dual-driver
• #86: feat: remove built-in Playground feature
• #89: fix(db): enable TLS for Postgres (Heroku)
• #90: fix(providers): resolve custom provider aliases to UUID-backed executors
• #91: feat(antigravity): add gemini-3.8-flash model support
• #92: fix: Claude Code v2 compatibility — system role, adaptive thinking, unknown model warning
• #93: fix(db): enable TLS for Postgres (Heroku)
• #94: fix: Postgres compatibility — quote camelCase aliases + coerce BIGINT buckets
• #95: fix(providers): resolve custom provider aliases to UUID-backed executors
• #98: docs(skills): update and modularize SRouter agent skills

Full Changelog: v0.1.4...v0.1.5

SRouter v0.1.4

SRouter v0.1.4

Release date: 2026-09-01

Summary

v0.1.4 is a feature-heavy release focused on provider flexibility, security hardening, dashboard polish, and a complete settings redesign. Includes bulk account onboarding, B.AI provider support, per-key model restrictions, and a security audit pass.

---

🚀 New Features

• Bulk add accounts for Qoder PAT and Codex tokens — one-shot onboarding of multiple credentials (#66, #65)
• B.AI provider support with default free models (#67)
• allowed_models restriction for virtual API keys — limit which models a key can route (#66)
• srouter init CLI command for Docker and Source Code execution (#65)
• Custom provider dialog in the providers catalog (#76)
• Mesh routing topology redesign — hub-and-spoke radial orbit with live request glow (#63)
• Analytics page design spec — RPS, top models, traffic health (spec-only, implementation follows in a separate PR) (#79)

🎨 UI/UX

• Minimal single-scroll settings page — complete redesign: no tabs, no card boxes, hairline-separated sections, 34 kB settings chunk (down from 67 kB) (#81)
• API keys management polish — better UX + key editing support (#70)
• Custom provider category removed from creation sheet, leaner catalog cards (#61)
• Connect OAuth modal polish (#76)

🛡️ Security Hardening

• Tunnel auth, CORS/CSRF, rate limiting, request limits, SSRF, esbuild — full security audit pass (#75)
• developer role normalization — accept developer role from OpenAI SDK v5+, normalize to system

⚡ Performance

• SQLite pragmas and indexes optimization (#69)

🧰 Refactors & Infrastructure

• Standardized schemas to snake_case across types/api/web + provider verification fix (#73)
• Pricing catalog synced with models.dev dataset + update script (#74)
• Docker data persisted to host ~/.srouter via bind mount
• Docker publish workflow re-enabled (manual dispatch only)

🐛 Fixes

• Restore custom models feature (#60)
• Fix fallback registry category to api_key (#62)
• Fix CLI bin entrypoint and isolate CLI_VERSION (#67)
• Fix 9router JSON backup migration (#65)
• Update provider categories to free_tier (GoRouter, TabiToken, BluesMinds, SeekAI)
• Adaptive currentColor SVG for OpenCode Zen logo

---

📋 PR & Issue References

PR	Description
#81	Minimal single-scroll settings page
#79	Analytics page design spec
#76	Custom provider dialog
#75	Security hardening (tunnel/CORS/CSRF/rate-limit/SSRF)
#74	Pricing sync + update script
#73	snake_case schema standardization
#70	API keys UX + editing
#69	SQLite perf
#67	B.AI provider
#66	allowed_models + bulk accounts
#65	srouter init + 9router migration
#63	Mesh topology redesign
#62	Fallback registry fix
#61	Remove custom provider category
#60	Restore custom models

🔄 Upgrade Notes

• Docker: data now persists to ~/.srouter via bind mount — pull ghcr.io/seaavey/srouter:latest
• CLI: srouter init scaffolds Docker/source execution; srouter migrate supports 9router JSON backups

---

Full changelog: compare v0.1.3...v0.1.4

SRouter v0.1.3

SRouter v0.1.3

SRouter v0.1.3 brings major architectural improvements with strict TypeScript type safety, full monorepo-wide PascalCase standardizations, new provider additions (CodeBuddy CN), Gemini & Antigravity token cache mapping, native multi-arch Docker CI pipelines, and a refined password-first dashboard authentication flow.

---

🚀 Key Highlights & New Features

🇨🇳 CodeBuddy CN Provider Support

• Full OAuth Device Flow & Quota Integration: Seamlessly connect CodeBuddy CN accounts via device-code flow with automated token refresh and real-time live quota monitoring.

🧠 Antigravity & Gemini Token Cache Mapping

• Cache Token Awareness: Integrated cachedContentTokenCount usage translation for Gemini / Antigravity payload adapters to accurately evaluate cached prompt costs.
• Standardized Antigravity translator namespace across packages.

🔒 Password-First Dashboard Auth & Remote Access

• Streamlined Onboarding: Removed restrictive 12-character minimum password limits for local setups.
• Remote Access Routing Fix: Resolved apiKeyAuth catch-all interference that previously blocked dashboard UI assets and admin endpoints on remote setups.

🛡️ Monorepo-Wide Strict Type Safety & Clean Architecture

• Zero unknown/any Policy: Eliminated loose type casts across dialect adapters (@srouter/translator), response builders, and event streams.
• Strict SQLite Row Types: All database row models in @srouter/db strictly map to concrete types (string, number, null).
• Standardized PascalCase Conventions: Renamed and standardized all controllers (AdminController, TunnelController, ChatController, AuthController, KeysController, etc.), middleware (AdminAuth, ApiKeyAuth, Validation), and domain logic.
• Modular Zod Schemas: Extracted and centralized route validation schemas into @srouter/types/src/schemas/.
• Modular Provider Constants: Per-provider definitions, metadata, and catalogs isolated into packages/constants/src/providers/.
• Custom Models Deprecation: Cleaned up legacy custom models tables and database schemas in favor of direct catalog & provider matching.

⚡ Native Multi-Arch Docker CI

• Rebuilt GitHub Actions publishing pipeline to build linux/amd64 and linux/arm64 images on native runners with proper manifest annotations.

---

🔗 Pull Requests & Commits

• #59 — refactor(translator): decompose message mappers and enforce strict types by @seaavey
• #58 — feat(providers): remove custom models feature and clean up schema by @seaavey
• #57 — refactor(db): enforce strict row typing and PascalCase query standards by @seaavey
• #56 — chore(release): bump version to 0.1.2-rc.2 and modularize provider constants by @seaavey
• #54 — refactor(routes): extract AdminController and TunnelController, add Zod schemas and clean route declarations by @seaavey
• #53 — refactor(middleware): rename to ApiKeyAuth.ts & Validation.ts and enforce PascalCase by @seaavey
• #52 — refactor(middleware): rename adminAuth.ts to AdminAuth.ts by @seaavey
• #51 — refactor(middleware): remove redundant adminAuth/requireAdmin aliases and enforce PascalCase by @seaavey
• #50 — style: format all files with prettier by @seaavey
• #49 — refactor(models): standardize ModelsLogic to PascalCase, simplify matching and add Zod schemas by @seaavey
• #48 — refactor(controllers): standardize all API controllers with PascalCase and clean response helpers by @seaavey
• #47 — refactor(chat,providers): standardize controllers & logic with PascalCase and strict typing by @seaavey
• #46 — feat(auth,types,api): response helpers, zod modularization, and auth polling types by @seaavey
• #45 — ci(docker): remove check-version job from docker-publish workflow by @seaavey
• #44 — refactor(auth): centralize auth types, namespace provider handlers, and clean controllers by @seaavey
• #43 — refactor(auth): simplify auth controller and routes to pure JSON by @seaavey
• #41 — feat(providers): add CodeBuddy CN provider with OAuth device flow and live quota by @Sienz16
• #40 — feat(auth): password-first setup, fix remote dashboard access, drop 12-char minimum by @Sienz16
• #39 — ci(docker): fix merge job failure — quote labels, inspect real tag by @Sienz16
• #38 — ci(docker): write digest to a file before uploading as artifact by @Sienz16
• #37 — ci(docker): build multi-arch images on native runners by @Sienz16

---

👥 Contributors

Huge thanks to everyone contributing to SRouter v0.1.3:

• @seaavey (Muhammad Adriansyah)
• @Sienz16

---

🐳 Docker Container & Quick Start

# Pull latest stable v0.1.3
docker pull ghcr.io/seaavey/srouter:0.1.3
docker pull ghcr.io/seaavey/srouter:latest

# Run container
docker run -d \
  --name srouter \
  -p 3000:3000 \
  -p 1455:1455 \
  -v srouter_data:/app/data \
  ghcr.io/seaavey/srouter:0.1.3

---

Full Changelog: v0.1.2...v0.1.3

SRouter v0.1.2

SRouter v0.1.2

SRouter v0.1.2 introduces built-in Cloudflare Tunnel management directly from the web dashboard, hardened API security for public/remote deployments, centralized version constants across the monorepo, zero-cost rate evaluation for free model tiers, and critical SQLite concurrency stability fixes.

---

🚀 Key Highlights & New Features

🌐 Built-in Cloudflare Tunnel Management

• One-Click Zero Trust Expose: Manage Cloudflare Tunnels directly from the control plane dashboard without manual CLI setup.
• Automated Daemon Lifecycle: Automated installation for the cloudflared binary, real-time connection status via Server-Sent Events (SSE), and automatic background tunnel restart on server boot.
• Security Guardrails: Tunnel installation and status modification endpoints are guarded by adminAuth.

🛡️ Security Hardening & Public API Protection

• Mandatory Virtual API Key for Remote Traffic: Requests originating outside loopback (127.0.0.1 / ::1) strictly require a valid virtual key (sr-live-*), closing unauthorized access vectors when SRouter is exposed publicly.
• SSRF Attack Guard: Provider endpoint verification rejects internal cloud metadata endpoints (169.254.169.254, metadata.google.internal, instance-data) and local loopback/private subnets.
• Security Headers & Sanitized CORS: Implemented default HTTP security headers (X-Powered-By: Seaavey, X-Version, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, X-XSS-Protection, Referrer-Policy) and tightened CORS origin reflection when credentials: true.
• Loopback OAuth Server: OAuth callback server on port 1455 binds to 127.0.0.1 by default.

💰 Zero-Cost Pricing for Free Model Tiers

• Models with names or tags including :free, /free, or -free (e.g. OpenCode Zen free tier, OpenRouter free models, DeepSeek R1 free) are automatically calculated at $0.00 / token across all token types in quota and cost logs.

🧩 Centralized Version Constants

• Replaced fragmented version literals with single-source-of-truth constants in @srouter/constants (GLOBAL_VERSION, APP_VERSION, API_VERSION, CLI_VERSION).

⚡ Optimized CI/CD Workflow

• Docker multi-arch GHCR publishing pipeline now evaluates release tags and automatically skips costly image builds for pre-release / Release Candidate (-rc) versions.

---

🛠️ Bug Fixes & Improvements

• SQLite Concurrency Resilience: Handled table schema migration race conditions to tolerate duplicate column additions during concurrent multi-process initialization.
• Loopback Spoofing Elimination: Removed untrusted Host header fallbacks in client IP discovery.
• Topbar UI Polish: Streamlined top navigation bar by removing redundant logout trigger.
• Modular In-Repo Agent Skills: Divided legacy monolithic guide into targeted skills: SRouter-API, SRouter-APP, and SRouter-CLI.

---

🔗 Pull Requests & Related Changes

• #36 — feat(tunnel): built-in Cloudflare Tunnel management with token auth and custom domain by @seaavey
• #35 — feat(security): harden public API access and add security headers by @seaavey
• Commit 6e6e19c — feat(pricing): resolve free models to 0 cost rate by @seaavey
• Commit 19c423c — refactor(constants): provide GLOBAL_VERSION, APP_VERSION, API_VERSION, and CLI_VERSION by @seaavey
• Commit 8f693cc — ci(ghcr): separate check-version job to cleanly skip build on rc releases by @seaavey

---

👥 Contributors & Special Thanks

Special thanks to all contributors who helped build and test this release:

• @seaavey (Muhammad Adriansyah)

---

🐳 Docker Container & Assets

Production container images for amd64 and arm64 are available via GitHub Container Registry (GHCR):

# Pull latest stable v0.1.2 release
docker pull ghcr.io/seaavey/srouter:0.1.2
docker pull ghcr.io/seaavey/srouter:latest

# Run with persistent volume
docker run -d \
  --name srouter \
  -p 3000:3000 \
  -p 1455:1455 \
  -v srouter_data:/app/data \
  ghcr.io/seaavey/srouter:0.1.2

---

Full Changelog: v0.1.1...v0.1.2

v0.1.1 - Smart Model Combos, Failover Cascades & Robust Resilience

⚡ SRouter v0.1.1 — Smart Model Combos, Token Saver & Resilient Gateway

SRouter v0.1.1 is a major feature and stability release introducing Smart Model Fallback Cascades & Priority Combo Routing, an intelligent Multi-Stage Token Saver Engine, full Anthropic Messages API protocol compliance, and resilient error recovery across all gateway routes.

---

🌟 What's New in v0.1.1

🔀 Smart Model Combos & Automated Failover Cascades (/combo)

• Grouped Visual Pipeline: Intuitive multi-tier cascade visualization (Step 1 Primary ➔ Step 2 Failover ➔ Step 3 Backup) with provider branding logos and model capability badges (Vision 👁️ & Reasoning 🧠).
• macOS-Style Dialog & Model Picker: Streamlined modal dialog with live regex validation, model priority reordering, and model selector modal categorized by provider.
• 1-Click Starter Templates: Quick presets for Flagship Fallback Chain, High Throughput & Speed, and Deep Reasoning Mix.
• Zero Idle Latency: Combo virtual aliases directly route to target model chains without candidate 0 execution delays.
• Case-Insensitive Resolution: Fallback matching supports case-insensitive model identifiers (claude matches Claude).
• Resilient Fallback Triggers: Automated failover on HTTP 429, 403, 5xx, missing provider drivers, rate limit exhaustion, and upstream connection failures.
• Quick Devtools: Direct "Test in Playground" (/playground?model=...) and instant "Copy cURL" command export.

✂️ Multi-Stage Token Saver Engine (/settings/token-saver)

• Prompt Token Compaction: Rule-based token optimization reducing prompt overhead and upstream billing cost before LLM execution.
• Customizable Rules: Whitespace compaction, redundant code comments pruning, and repetitive string compression.
• Dashboard Telemetry: Dedicated UI showing estimated token savings, reduction percentages, and audit metrics.

🔌 New Upstream AI Providers & Protocol Bridges

• Expanded Provider Catalog: Native executors for GoRouter, BluesMinds, SeekAI, TabiToken, Neosantara, and Qoder (Alibaba Cloud PKCE OAuth flow with WAF bypass).
• Anthropic Messages API: Native POST /v1/messages & POST /messages support with bidirectional tool calling and SSE streaming (compatible with Claude Code CLI, Cursor, and official Anthropic SDKs).

🛡️ Robust Validation & Error Handling

• Graceful JSON Parsing: Handles malformed JSON payloads and empty bodies returning standard OpenAI invalid_request_error (HTTP 400) without throwing unhandled Hono HTTPException.
• Global Error Normalization: Centralized error interceptors across primary API listeners and port 1455 OAuth servers.

---

🔗 Pull Requests & Related Changes

PR / Issue	Description	Author
#23	feat(routing): introduce Smart Model Fallback Cascades & Priority Combo Routing	@seaavey
#22	feat(token-saver): add multi-stage token saver engine and web dashboard	@seaavey
#21	feat(gateway): Multi-Provider Priority Failover & Fallback Rules Engine	@seaavey
#20	fix(web): unbreak dashboard onConnect & handle multi-tenant OAuth refresh	@Sienz16
#19	fix(models): speed up provider model discovery with concurrent background sweeps	@Sienz16
#18	fix(docker): make pnpm workspace caching resilient	@Sienz16
#17	feat(auth): add first-run admin onboarding & JWT session management	@Sienz16
#16	fix(docker): copy per-package manifests for faster Turbo caching	@Sienz16
#14	feat(api): add Anthropic Messages API support with SSE delta streaming	@seaavey
#13	feat(provider): add Qoder OAuth PKCE & Alibaba Cloud upstream proxy	@seaavey
#10	feat: add Neosantara provider integration	@seaavey

📌 Closed Issues

• #12: Request: Add Qoder gateway
• #15: Add Docker Compose & Multi-stage deployment

---

💖 Special Thanks & Contributors

Huge thanks to everyone who contributed to making this release possible!

• @seaavey (Lead Architect & Core Maintainer) — Gateway architecture, fallback cascades engine, model combos UI, Token Saver engine, and provider integrations.
• @Sienz16 — Admin onboarding auth flow, provider discovery concurrency optimizations, and Docker workspace caching enhancements.

---

Full Changelog: v0.1.0-beta...v0.1.1

v0.1.0-beta - Initial Public Beta Release

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

---

[0.1.0-beta] - 2026-08-15

🚀 Initial Public Beta Release

🔀 AI Gateway & Protocol Routing

• OpenAI & Anthropic Compatible Proxy: Full support for POST /v1/chat/completions, GET /v1/models, and GET /v1/models/:model.
• Server-Sent Events (SSE) Streaming: Real-time streaming chunks with usage breakdown normalization and thinking/reasoning model delta preservation.
• Protocol Translation: Automatic bidirectional translation between OpenAI JSON Schema function definitions and Anthropic tools.

🌐 Multi-Provider Catalog

• Supported Upstreams:
  • Google Antigravity (Gemini 2.5 Flash / Pro)
  • OpenAI Codex & ChatGPT (GPT-4o, o3-mini)
  • Anthropic Claude (Claude 3.7 Sonnet)
  • Neosantara AI
  • Kiro (Amazon Q / CodeWhisperer)
  • Command Code
• Dynamic Model Discovery: Direct upstream catalog polling without hardcoded model tables.
• Provider Management: Connect, configure, test, and manage upstream accounts.

🔄 Token Sweeper & OAuth PKCE

• Embedded OAuth Callback Server: Dedicated listener on port 1455 for seamless browser PKCE authorization.
• Automated Sweeper: 60-second periodic background daemon refreshing expiring OAuth tokens with lead time guarantees.

📊 Live Quotas & Limits (/quota)

• Real-Time Telemetry: Visual progress bars with status badges (ok, warning, exhausted).
• Reset Countdown Timers: Localized human-readable reset timestamps.
• Collapsible Provider Cards: Per-account cards with individual sync and global expand/collapse.

🔑 Virtual API Keys & Security (/keys, /settings)

• Virtual Client Keys: Secure sr-live-... keys for downstream clients with quota limits and usage tracking.
• Enforced Security Mode: Toggleable Require API Key gateway setting rejecting unauthorized requests with HTTP 401.
• Open Access Mode: Seamless unauthenticated access for local development and private sandboxes.

🧪 Web Playground (/playground)

• Interactive Chat Studio: Multi-session tabs, parameter tuning (temperature, max tokens, system prompts).
• Reasoning Visualization: Collapsible thinking blocks for reasoning models.
• One-Click Code Export: Copy cURL, Python, TypeScript, and JSON snippets instantly.

🎨 Editorial Minimalist UI

• Modern Stack: TanStack Table v8, TanStack Router, React 19, Tailwind CSS v4, Base UI.
• Theme Transitions: Dark/Light mode with View Transitions API.
• Responsive Layout: Fluid typography, Bento metric summaries, and sidebar navigation.