router-for-me/CLIProxyAPI v7.3.0

on GitHub

Linux release assets

• CLIProxyAPI_<version>_linux_<arch>.tar.gz is the default Linux build. It supports dynamic library plugins and is built against a GLIBC 2.17 baseline.
• CLIProxyAPI_<version>_linux_<arch>_no-plugin.tar.gz is the portable Linux build for musl-based or older systems such as OpenWrt. It does not support dynamic library plugins.

FreeBSD release assets

• CLIProxyAPI_<version>_freebsd_aarch64_no-plugin.tar.gz is the FreeBSD arm64 build. It is built without CGO and does not support dynamic library plugins.

Changelog

• feat(codex): forward X-Codex-Turn-State header in executor requests (e696ea4)
• feat(codex): preserve native fidelity for responses-lite requests (f702bc1)
• feat(cooldowns): add cooldown snapshot feature for management auth files (1ca975d)
• docs(config): document payload filter examples for codex tools (94d6eb5)
• Merge pull request #5795 from router-for-me/feat/management-auth-cooldowns (d23ba5e)
• feat(devin): add Devin/Cognition provider integration and CLI OAuth (f947527)
• feat(devin): bind upstream session_id and cascade_id to CPA canonical session (cbe800a)
• feat(devin): prefix all Devin model IDs with devin/ namespace (eed2490)
• feat(devin): restrict glm-5-2 to free tier, remove static swe-1-7-lightning, and harden cloak (02fd1bd)
• fix(devin): restrict sensitive word obfuscation strictly to system prompt only (f5247e4)
• feat(devin): support sensitive-words in auth json metadata and attributes (1b69485)
• refactor(devin): align sensitive-words with antigravity to config.yaml only (d115fe2)
• fix(devin): sanitize claude subagent identity and emoji directives to prevent content policy 403 (c0b8605)
• refactor(devin): keep sensitive words strictly external in config.yaml without hardcoding (c0b76c2)
• feat(devin): support credential quota and seat status query via GetUserStatus (7b5741c)
• fix(devin): strip system prompt lines matching configured sensitive words to evade unicode normalization bypass (5b8e382)
• feat(devin): add devin/gemini-3-8-flash and devin/grok-4-6 model definitions and signature recognition (ea2f29f)
• feat(devin): enhance request-log with intermediate interactions and decoded upstream body (2caab7d)
• docs(devin): document cloud-side system instructions baseline in DevinExecutor (8a37707)
• feat(devin): add deepseek-v4-flash and deepseek-v4-1-flash models (308e5ad)
• feat(devin): support none thinking level for glm-5-2 (0c2351b)
• docs(devin): update DevinExecutor comment with verbatim reconstructed cloud system prompt (59df75d)
• feat(devin): add standalone devin_models.json catalog and remote updater (982cd12)
• feat(devin): auto-namespace model IDs from clean devin_models.json (6174174)
• feat(devin): add symmetric decoded upstream response in request log (16cb6c0)
• feat(devin): parse protobuf timestamp and harden partial failure logging (469aa36)
• feat(cmd): add fetch_devin_models CLI tool for dynamic model catalog extraction (2683ec2)
• feat(devin): clamp maxTokens to model MaxCompletionTokens (ca664c6)
• feat(devin): map model aliases and swe-1-7/haiku/sonnet/gpt-4-1 UIDs (bf06746)
• feat(registry): auto-populate Gemini token limits and generation methods for Devin models (0aedd05)
• fix(devin): calculate total_input_tokens and total_tokens correctly (85ddf3a)
• feat(registry): transparently resolve un-prefixed devin models in auth selection (fbabc27)
• Revert "feat(registry): transparently resolve un-prefixed devin models in auth selection" (a0ccc3a)
• fix(util): enforce strict devin/ prefix requirement for devin provider (ca159b3)
• fix(devin): align wire protocol, harden streaming, and resolve multi-turn tool/signature parity (f1f5506)
• fix(devin): sort streaming tool call stop events and normalize prompt CRLF (a5ea971)
• fix(devin): guard against reopening thought step on late-arriving signatures (2f2f9b4)
• fix(devin): bound tool call indices against OOM, set Refresh timeout, and check manual callback state (d754298)
• fix(devin): update streaming tool call step metadata if arriving in subsequent frames (50dd582)
• fix(devin): enforce Connect-RPC EOS trailer invariant, validate frame flag, and bind OAuth callback to ctx (5d0c77c)
• perf(devin): cache sensitive word regex matcher, preallocate request bytes and frame decompression buffer (6c7d2d5)
• perf(devin): eliminate O(K^2) tool call argument string allocations using strings.Builder (6df8f32)
• perf(devin): cache Devin HTTP transports per proxy URL to reuse connection pools (86de823)
• fix(devin): propagate stream chunk errors, fix truncated protobuf infinite loop, respect ctx roundtripper, and limit auth response body reads (6a239f5)
• fix(devin): store transient quota metrics strictly in Quota.Signals and keep Metadata static (98b106f)
• fix(devin): normalize upstream internal errors to 502 Bad Gateway (1604cb0)
• fix(devin): dynamic catalog-driven chat_model_uid resolution and effort clamping (926450e)
• fix(devin): transport reuse, interleaved stream steps, strings.Builder panic, and updater URL (fb2c1c1)
• feat(devin): integrate global signature detector for cross-provider signature detection (9d190f3)
• refactor(devin): deduplicate auth credentials extraction, filter sparse tool calls, and optimize model lookup (30b2ac8)

What's Changed

• feat(cooldowns): add cooldown snapshot feature for management auth files by @LTbinglingfeng in #5795
• feat(devin): add Devin / Cognition Connect-RPC provider integration by @sususu98 in #5789

Full Changelog: v7.2.159...v7.3.0