diegosouzapw/OmniRoute v3.6.4

on GitHub

✨ New Features

• Combo Builder v2 (Wizard UI): Completely redesigned the combo creation/editing interface as a multi-stage wizard with stages: Basics → Steps → Strategy → Review. The builder fetches provider, model, and connection metadata via a new GET /api/combos/builder/options endpoint, enabling precise provider/model/account selection with duplicate detection and automatic next-connection suggestion. Heavy UI components (ModelSelectModal, ProxyConfigModal, ModelRoutingSection) are now lazily loaded via next/dynamic for faster initial page render
• Combo Step Architecture (Schema v2): Introduced a structured step model (ComboModelStep, ComboRefStep) replacing the legacy flat string/object combo entries. Steps carry explicit id, kind, providerId, connectionId, weight, and label fields, enabling pinned-account routing, cross-combo references, and per-step metrics. All combo CRUD operations normalize entries through the new src/lib/combos/steps.ts module. Zod schemas updated with comboModelStepInputSchema and comboRefStepInputSchema unions
• Composite Tiers System: Added tiered model routing via config.compositeTiers — each tier maps a named stage to a specific combo step with optional fallback chains. Includes comprehensive validation (src/lib/combos/compositeTiers.ts) ensuring step existence, preventing circular fallback, and validating default tier references. Zod schema enforcement blocks composite tiers on global defaults (concrete combos only)
• Model Capabilities Registry: Created src/lib/modelCapabilities.ts providing getResolvedModelCapabilities() — a unified resolver that merges static specs, provider registry data, and live-synced capabilities into a single ResolvedModelCapabilities object covering tool calling, reasoning, vision, context window, thinking budget, modalities, and model lifecycle metadata
• Observability Module: Extracted health and telemetry payload construction into src/lib/monitoring/observability.ts with buildHealthPayload(), buildTelemetryPayload(), and buildSessionsSummary() builders. The health endpoint now returns session activity, quota monitor status, and per-provider breakdowns alongside existing system metrics
• Session & Quota Monitor Dashboard: Added live Session Activity and Quota Monitors panels to the Health dashboard, showing active session counts, sticky-bound sessions, per-API-key breakdowns, and top session details alongside quota monitor alerting/exhausted/error status with per-provider drill-down
• Combo Health Per-Target Analytics: The combo-health API now resolves per-target metrics using the new resolveNestedComboTargets() function, providing step-level success rates, latency, and historical usage breakdowns per execution key — enabling per-account, per-connection health visibility
• Auto-Combo → Combos Unification: Merged the separate /dashboard/auto-combo page into the main /dashboard/combos page. Auto/LKGP combos are now managed alongside all other combos with a new strategy filter tabs system (All / Intelligent / Deterministic). The old auto-combo route redirects to /dashboard/combos?filter=intelligent. Removed the auto-combo sidebar entry, consolidating navigation into the single Combos item
• Intelligent Routing Panel (IntelligentComboPanel): New inline panel (371 lines) within the combos page that shows real-time provider scores, 6-factor scoring breakdown (quota, health, cost, latency, task fitness, stability), mode pack selector, incident mode status, and excluded providers for auto/lkgp combos — replacing the former standalone auto-combo dashboard
• Builder Intelligent Step (BuilderIntelligentStep): New conditional wizard step (280 lines) that appears in the Builder v2 flow only when strategy=auto or strategy=lkgp is selected. Exposes candidate pool selection, mode pack presets, router sub-strategy selector, exploration rate slider, budget cap, and collapsible advanced scoring weights configuration
• Intelligent Routing Module (intelligentRouting.ts): Extracted strategy categorization and filtering logic into a dedicated shared module (210 lines) with getStrategyCategory(), isIntelligentStrategy(), filterCombosByStrategyCategory(), normalizeIntelligentRoutingFilter(), and normalizeIntelligentRoutingConfig() utility functions
• LKGP Standalone Strategy: Implemented lkgp (Last Known Good Provider) as a fully functional standalone combo strategy. Previously, lkgp as a combo strategy silently fell through to priority ordering — the LKGP lookup only ran inside the auto engine. Now strategy: "lkgp" correctly queries the LKGP state, moves the last successful provider to the top of the target list, and saves the LKGP state after each successful request. Falls back to priority ordering when no LKGP state exists
• Unified Routing Rules & Model Aliases: Consolidated the routing rules and model alias management controls into the Settings page, reducing fragmentation across the dashboard

⚡ Performance

• Middleware Lazy Loading: Refactored src/proxy.ts to lazy-import apiAuth, db/settings, and modelSyncScheduler modules, reducing middleware cold-start overhead. Added inline isPublicApiRoute() to avoid loading the full auth module for public routes
• E2E Auth Bypass: Added NEXT_PUBLIC_OMNIROUTE_E2E_MODE environment flag to bypass authentication gates for dashboard and management API routes during Playwright E2E test runs

🐛 Bug Fixes

• P2C Credential Selection: Implemented Power-of-Two-Choices (P2C) connection scoring in src/sse/services/auth.ts with quota headroom awareness, error/recency penalties, and forced/excluded connection support. The new getProviderCredentialsWithQuotaPreflight() function integrates quota preflight checks directly into credential selection, eliminating the separate Codex-only preflight path
• Fixed-Account Combo Steps: Combo steps with explicit connectionId now correctly bypass provider-level model cooldowns and circuit breakers, preventing a single account failure from blocking pinned-connection routing for the same model
• Combo Metrics Per-Target Tracking: Extended comboMetrics.ts to track byTarget metrics keyed by execution path, recording per-step provider, providerId, connectionId, and label alongside existing per-model aggregates
• Call Logs Schema Expansion: Added requested_model, request_type, tokens_cache_read, tokens_cache_creation, tokens_reasoning, combo_step_id, and combo_execution_key columns to call_logs with auto-migration. Added composite index idx_cl_combo_target for efficient per-target historical queries
• Quota Monitor Enrichment: Expanded quotaMonitor.ts with full lifecycle state tracking (status, startedAt, lastPolledAt, consecutiveFailures, totalPolls, totalAlerts), ISO-formatted snapshots via getQuotaMonitorSnapshots(), and sorted summary via getQuotaMonitorSummary()
• Codex Quota Fetcher Hardening: Improved codexQuotaFetcher.ts with safer connection registration and quota fetch error handling
• LKGP Save Refactored to Async/Await: Replaced fire-and-forget .then() chain for LKGP persistence after successful combo routing with proper async/await + try/catch, preventing unhandled promise rejections and ensuring LKGP state is reliably saved before the response is returned
• Duplicate auto in Combo Strategy Schema: Removed duplicate "auto" entry from comboStrategySchema (was listed on both line 104 and 108). Harmless to Zod runtime but cleaned up to avoid confusion. Schema now has exactly 13 unique strategy values
• Legacy Combo Refs Normalization: Fixed combo step normalization to preserve legacy string combo references during CRUD operations, preventing data loss when editing combos created before the v2 step architecture

🔒 Security

• Auth Bypass on Backup Routes (Critical): Added isAuthenticated guards to /api/db-backups/exportAll (full database export) and /api/db-backups (list, create, and restore backups) — both were previously accessible without authentication
• Auth Guard on Translator Save: Added isAuthenticated guard to /api/translator/save for defense-in-depth consistency
• API Key Secret Hardening: Removed the hardcoded "omniroute-default-insecure-api-key-secret" fallback from apiKey.ts — the function now fails fast if API_KEY_SECRET is unset, relying on the startup validator to auto-generate it
• NPM Tarball Leak Fix: Added app/.env* to .npmignore to prevent the working .env file from being shipped inside the npm tarball distribution
• Electron Builder CVE Fix: Bumped electron-builder to 26.8.1 to resolve tar CVEs in the desktop build pipeline

🔧 Maintenance & Infrastructure

• DB Migration 021: Added combo_call_log_targets migration for combo_step_id and combo_execution_key columns in call_logs
• Combo CRUD Normalization: db/combos.ts now normalizes all stored combo entries through the step normalization pipeline on read, ensuring consistent step IDs and kind annotations regardless of when the combo was created
• Playwright Config: Updated Playwright configuration and run-next-playwright.mjs script for improved E2E test orchestration
• Build Script: Updated build-next-isolated.mjs with additional reliability improvements
• Auto-Combo UI Cleanup: Deleted AutoComboModal.tsx (161 lines), replaced auto-combo/page.tsx (478→5 lines) with a server-side redirect to /dashboard/combos?filter=intelligent
• Sidebar Consolidation: Removed "auto-combo" from HIDEABLE_SIDEBAR_ITEM_IDS and PRIMARY_SIDEBAR_ITEMS — normalizeHiddenSidebarItems() silently discards any stale "auto-combo" entries in user settings
• Schema Cleanup: Removed obsolete createAutoComboSchema from schemas.ts. Exported comboStrategySchema for direct use in test and filter modules
• A2A Agent Card Update: Renamed skill ID from auto-combo to intelligent-routing with updated description referencing the unified combos dashboard
• Builder Draft Refactor: Extended builderDraft.ts with dynamic stage list generation via getComboBuilderStages() and isIntelligentBuilderStrategy(). Stage navigation (getNextComboBuilderStage, getPreviousComboBuilderStage, canAccessComboBuilderStage) now accepts options to conditionally include/skip the intelligent wizard step
• i18n Consolidation: Removed the standalone "autoCombo" i18n block (22 keys) from all 30 language files. Migrated keys into the "combos" block with new additions for filter tabs, intelligent panel, and builder step labels

🧪 Tests

• 16 New Test Suites: Added comprehensive test coverage including:
• combo-builder-draft.test.mjs (186 lines) — Builder draft step construction and validation
• combo-builder-options-route.test.mjs (228 lines) — Builder options API endpoint
• combo-health-route.test.mjs (266 lines) — Combo health analytics with per-target metrics
• combo-routes-composite-tiers.test.mjs (157 lines) — Composite tiers API integration
• composite-tiers-validation.test.mjs (131 lines) — Composite tier validation rules
• db-combos-crud.test.mjs — Combo CRUD with step normalization
• db-core-init.test.mjs (129 lines) — DB initialization and column migrations
• model-capabilities-registry.test.mjs (105 lines) — Model capabilities resolution
• observability-payloads.test.mjs (165 lines) — Health/telemetry payload construction
• openapi-spec-route.test.mjs — OpenAPI spec generation
• proxy-e2e-mode.test.mjs (74 lines) — E2E mode auth bypass
• quota-monitor.test.mjs — Quota monitor lifecycle state
• run-next-playwright.test.mjs (119 lines) — Playwright runner script
• sse-auth.test.mjs (154 lines) — P2C credential selection and quota preflight
• telemetry-summary-route.test.mjs (35 lines) — Telemetry summary endpoint
• Plus updates to 12 existing test files for compatibility with new step architecture
• Auto-Combo Unification Tests:
• autocombo-unification.test.mjs (156 lines) — Strategy categorization, schema deduplication, sidebar cleanup, and routing strategies metadata validation
• combo-unification.spec.ts (189 lines) — Playwright E2E tests for filter tabs, intelligent panel rendering, redirect from old route, sidebar entry removal, and Builder v2 intelligent step flow
• 3 new LKGP standalone tests in combo-routing-engine.test.mjs — Validates LKGP provider prioritization, fallback to priority when no state exists, and LKGP state persistence after successful requests
• Updated combo-builder-draft.test.mjs with intelligent stage navigation tests
• Updated sidebar-visibility.test.mjs to reflect auto-combo removal