Merge origin/master (v0.5.91) into gitea/new_feature

Resolve conflicts:
- streamingHandler.js: adopt upstreamResponseHeaders while keeping 0-token detail row avoidance
- capabilities.js: preserve user-asserted caps and globalThis slots without local caching of catalogSource
- AddCustomModelModal.js & providers/[id]/page.js: wire STT transport marker with custom model edits/assertions
- models/custom/route.js & aliasRepo.js: persist custom model transport and invalidate user caps
- usageRepo.js: key byApiKey live stats by full API key and keep tail in maskApiKey
- UsageStats.js: lazy load charts dynamically

open-sse/providers/capabilities.js

@@ -430,21 +430,29 @@ const TRUST_UPSTREAM_VISION = new Set(["openrouter"]);
  *
  * @param {string[]} comboModels
  * @param {Object|null} [comboLookup] optional map of combo name → models array for nested resolution
+ * @param {Function|null} [resolveCaps] optional (fullId) → caps override. The synced model
+ *   catalog is server-only (it reads a file), so a browser-side resolution cannot see the
+ *   limits it supplies and silently falls back to the generic patterns below. Callers that
+ *   have the server's answer (/api/models, via useModelCaps) pass it here; it is merged over
+ *   the local tables, so fields it does not carry (tools, pdf, audio/video, thinking*) survive.
  * @param {number} [_depth] internal recursion depth guard
  * @returns {object|null} full capabilities object, or null for empty input
  */
-export function aggregateComboCapabilities(comboModels, comboLookup = null, _depth = 0) {
+export function aggregateComboCapabilities(comboModels, comboLookup = null, resolveCaps = null, _depth = 0) {
   if (!comboModels?.length || _depth > 6) return null;
   const allCaps = comboModels.map((fullId) => {
     // Nested combo: bare name (no slash) that exists in the lookup — recurse
     if (!fullId.includes("/") && comboLookup?.[fullId]) {
-      return aggregateComboCapabilities(comboLookup[fullId], comboLookup, _depth + 1)
+      return aggregateComboCapabilities(comboLookup[fullId], comboLookup, resolveCaps, _depth + 1)
+          ?? resolveCaps?.(fullId)
           ?? getCapabilitiesForModel(null, fullId);
     }
     const slash = fullId.indexOf("/");
     const provider = slash === -1 ? null : fullId.slice(0, slash);
     const model = slash === -1 ? fullId : fullId.slice(slash + 1);
-    return getCapabilitiesForModel(provider, model);
+    const local = getCapabilitiesForModel(provider, model);
+    const override = resolveCaps?.(fullId);
+    return override ? { ...local, ...override } : local;
   });
   const first = allCaps[0];
   return {
@@ -482,7 +490,9 @@ const MODALITY_KEYS = ["vision", "pdf", "audioInput", "videoInput"];
 // handlers (silently: the setters still "succeed"). The slots therefore live on
 // globalThis, which IS shared across server bundles in the same process.
 // Same reason the browser bundle is safe: it never calls a setter, so the slots
-// stay empty and every consumer below short-circuits.
+// stay empty and every consumer below short-circuits. Every read goes through
+// globalThis: caching it locally would keep a reader alive in other copies after
+// setCatalogSource(null).
 let catalogSource = null;
 const SOURCE_SLOTS = (globalThis.__9R_CAPABILITY_SOURCES ||= {
   catalog: null, // { getModalities, getLimits } — synced models.dev catalog
@@ -496,15 +506,13 @@ const SOURCE_SLOTS = (globalThis.__9R_CAPABILITY_SOURCES ||= {
  */
 export function setCatalogSource(source) {
   catalogSource = source || null;
-  SOURCE_SLOTS.catalog = source || null;
+  if (SOURCE_SLOTS) SOURCE_SLOTS.catalog = source || null;
   if (typeof globalThis !== "undefined") globalThis.__9rCatalogSource = source || null;
 }
 
 function getCatalogSource() {
-  if (catalogSource) return catalogSource;
-  if (SOURCE_SLOTS.catalog) return (catalogSource = SOURCE_SLOTS.catalog);
-  if (typeof globalThis === "undefined") return null;
-  return (catalogSource = globalThis.__9rCatalogSource || null);
+  if (typeof globalThis === "undefined") return catalogSource;
+  return SOURCE_SLOTS?.catalog || globalThis.__9rCatalogSource || null;
 }
 
 // Capabilities the user asserted per provider+model (dashboard "Add/Edit Model"