Commit Graph

834 Commits

Author SHA1 Message Date
2305e26e25 feat: pre-request token validation, mid-stream error handling, and usage stats improvements
- Qoder: handle mid-stream errors by returning proper error Response instead of embedding in stream
- Qoder: add refreshCredentials() to validate token via quota endpoint before requests
- chatCore: validate and refresh provider tokens before sending chat requests
- chatCore: bail early with 401 on unrecoverable token refresh errors
- Usage stats: track apiKey, comboName, fallbackHistory in request details
- Dashboard: improve Combos, Endpoint, Provider, Usage, and RequestDetails pages
- API keys route: upsert logic with provider_type support
- DB repos: usageRepo query improvements, requestDetailsRepo pagination, apiKeysRepo updates
2026-06-29 10:08:07 +07:00
1fe8115dad merge: resolve conflicts with origin/master - keep both local and remote features 2026-06-22 11:40:16 +07:00
98412aa0bb update: sync local changes with latest features 2026-06-22 11:26:25 +07:00
decolua
0c47c891e7 # v0.5.8 (2026-06-21)
## Features
- **Antigravity**: native image generation support (image models tagged kind:image, hiển thị trong media-providers UI)
- **CodeBuddy CN**: API key auth + credit quota tracker
- **CodeBuddy CN**: short model prefix alias "cbcn"

## Fixes
- **MiniMax-M3**: enable vision capability
- **Headroom**: support Docker sidecar proxy
- **Antigravity**: image executor fixes
- **mimo-free**: Chrome User-Agent rotation to bypass anti-abuse gate
- **cloudflare-ai**: flatten content-part arrays to string to avoid oneOf 400 (#1926)
- **Translator**: normalize tools to Anthropic-native shape for non-Anthropic providers
- **CLI**: handle Next.js 16 nested standalone output path (#1940)
- **Codex**: preserve custom tools during request normalization
- **next.config**: add new route for responses endpoint to API
2026-06-21 18:04:50 +07:00
decolua
34876762af # v0.5.8 (2026-06-21)
## Features
- **Antigravity**: native image generation support (image models tagged kind:image, hiển thị trong media-providers UI)
- **CodeBuddy CN**: API key auth + credit quota tracker
- **CodeBuddy CN**: short model prefix alias "cbcn"

## Fixes
- **MiniMax-M3**: enable vision capability
- **Headroom**: support Docker sidecar proxy
- **Antigravity**: image executor fixes
- **mimo-free**: Chrome User-Agent rotation to bypass anti-abuse gate
- **cloudflare-ai**: flatten content-part arrays to string to avoid oneOf 400 (#1926)
- **Translator**: normalize tools to Anthropic-native shape for non-Anthropic providers
- **CLI**: handle Next.js 16 nested standalone output path (#1940)
- **Codex**: preserve custom tools during request normalization
- **next.config**: add new route for responses endpoint to API
2026-06-21 18:03:45 +07:00
decolua
d9b9a192ef Fix AG 2026-06-21 18:01:33 +07:00
decolua
d4ecad24d3 fix(antigravity): add kind:image to image models so they show in media-providers UI
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 17:59:51 +07:00
Nautilaceae
5306bd904e feat(antigravity): native image generation support
Add image generation for Antigravity provider via gemini-3.1-flash-image
and gemini-3-pro-image, exposed through Text to Image UI and
/v1/images/generations.

- registry: serviceKinds ['llm','image'] + image model entries
- executor: image model detection + image_gen request envelope
- chatCore: force stream=false for image models (generateContent)
- nonStreamingHandler: parse inlineData -> markdown image
- imageGenerationCore: useExecutor fast-path for executor delegation
- imageProviders/antigravity: image adapter with image input support
- usage/google: image models in quota whitelist

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 17:54:32 +07:00
swatker
b4d2754d32 fix: enable vision capability for MiniMax-M3
The pattern matcher marked *minimax-m3* as vision: false, causing
9Router to strip image attachments before forwarding upstream. This
broke Claude Code / Cursor / Cline vision flows when routing through
MiniMax-M3.

Scoped vision: true to *minimax-m3* only. M2.7 and the catch-all
*minimax* pattern remain vision: false: those models are text-only
(per MiniMax docs / NVIDIA NIM model card), so forcing vision there
would send images to a model that errors instead of degrading.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 17:50:08 +07:00
Carmelo Campos
50ed79fe9e fix(headroom): support Docker sidecar proxy
Treat configured Headroom proxy as running when its /health endpoint
responds, even if local headroom CLI is not installed. Dashboard
Start/Stop stays limited to local loopback proxies while external
Docker sidecars can be enabled via HEADROOM_URL.

Closes #1948

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 17:45:27 +07:00
decolua
096491d8d7 chore: bump version to 0.5.7
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 17:45:23 +07:00
decolua
f6f7b14faa docs: update CHANGELOG for v0.5.7
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 17:33:10 +07:00
decolua
3e12bc27d2 fix(next.config): add new route for responses endpoint to API 2026-06-21 16:57:29 +07:00
decolua
36153fedbd fix(mimo-free): add Chrome User-Agent rotation to bypass anti-abuse gate
Fixes #1933 — upstream returns 403 "Illegal access" on the chat endpoint
when requests lack a browser-like User-Agent. Mirror OmniRoute mimocode
executor: rotate across 3 Chrome UA strings on both bootstrap and chat.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 16:51:47 +07:00
decolua
7baf293ccb fix(cloudflare-ai): flatten content-part arrays to string to avoid oneOf 400 (#1926)
Workers AI rejects OpenAI content-part array shape; flatten text parts
to a plain string per message before sending.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 16:46:21 +07:00
decolua
45240c19e5 fix(translator): normalize tools to Anthropic-native shape for non-Anthropic providers
Strip `type` field and fold `function.{name,description,parameters}` into
top-level {name, description, input_schema} before forwarding to Claude-format
endpoints. MiniMax (and other Anthropic-compatible providers) reject tools
carrying a `type` field with error code 2013 ("invalid tool type").

Refs #1939

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 16:26:17 +07:00
Janu Yoga
8321032e36 feat(codebuddy-cn): add API key auth + credit quota tracker
Two additions on top of the merged CodeBuddy CN OAuth provider:

1. API key auth — connect with a direct API key (sent as
   Authorization: Bearer), not only via OAuth device-code flow.
   - registry: add authModes ["oauth","apikey"] + hasOAuth; combined Bearer
     auth already forwards the key, token-refresh skips key connections.
   - providers POST: accept dual-auth providers (authModes includes
     "apikey") that live under category "oauth" — previously rejected as
     "Invalid provider". Also fixes the same latent gap for xai.

2. Quota tracker — surface CodeBuddy CN credit balance on the usage
   dashboard for both OAuth and API-key connections.
   - registry: add transport.usage.url (Tencent billing endpoint) +
     features.usage/usageApikey so the connection is quota-eligible.
   - new CN-scoped handler services/usage/codebuddy-cn.js: POST the billing
     meter endpoint, unwrap data.Response.Data.Accounts[]. The payload mixes
     two credit types that must not be merged:
       * refill/base ("基础体验包") — recurring allowance; cycle resets well
         before the resource expires (CycleEndTime << DeductionEndTime).
         Reads the *Cycle* balance, resetAt = next refresh. Cadence-labelled.
       * bonus ("活动赠送包") — one-shot credits that expire at CycleEndTime.
         Reads the plain Capacity balance. Labelled "Bonus Pack N".
     One quota row per package, soonest-expiring first.
   - register handler under "codebuddy-cn" in USAGE_HANDLERS.

Frontend needs no change — USAGE_SUPPORTED_PROVIDERS/USAGE_APIKEY_PROVIDERS
and the generic parseQuotaData branch already cover this shape.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 16:12:20 +07:00
nataondev
d1bb4ddbb7 fix(cli): handle Next.js 16 nested standalone output path (#1940)
Next.js 16 nests standalone output under the project directory name
when NEXT_TRACING_ROOT_MODE=workspace (e.g. standalone/9router/server.js
instead of standalone/server.js), causing build-cli.js to fail with
"Next.js standalone build not found".

Detect nested layout with backward-compatible fallback to existing
standalone/server.js and standalone/app/ paths.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 16:03:43 +07:00
Janu Yoga
791705ae7a feat(codebuddy-cn): add short model prefix alias "cbcn"
codebuddy-cn shipped without a short alias, making its model prefix the
longest of any provider (codebuddy-cn/glm-5.2). Add alias + uiAlias
"cbcn" so the prefix becomes cbcn/glm-5.2, consistent with qoder (qd),
kiro (kr), codex (cx). "cbcn" = CodeBuddy CN; reserves "cbai" for a
future codebuddy-ai (intl) provider.

Backward-compatible: full id codebuddy-cn/... still resolves (resolver
matches both id and alias).

Also regenerate tests/__baseline__/alias-baseline.json: idToAlias entry
codebuddy-cn now maps to cbcn, and cbcn joins the sorted modelKeys list.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 16:02:38 +07:00
Sutarto Jordan Chrisfivo
ed68bcedf8 fix(codex): preserve custom tools during request normalization
Add CODEX_PASSTHROUGH_TOOL_TYPES allowlist so Responses-native freeform
tools (e.g. grammar-backed apply_patch) survive normalizeCodexTools and
reach the upstream Codex Responses API intact.

Refs #1907

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-21 16:01:45 +07:00
decolua
13abe7f7f6 Fix AG 2026-06-21 15:58:38 +07:00
decolua
401d93bd5c fix(claude haiku): update handling of unsupported adaptive thinking and output_config.effort 2026-06-20 16:29:15 +07:00
decolua
9cdb8173d7 ChangeLog 2026-06-20 16:13:14 +07:00
Rehan Choirul
584cf66a70 fix(test): use POST /v1/messages to validate anthropic-compatible connections
GET /models is not part of the Anthropic API spec and many compatible
proxies do not implement it, causing the connection test to always fail
even with a valid API key.

Switch to POST /v1/messages with max_tokens=1 — the same approach used
for the built-in anthropic provider — and treat any non-401/403 response
as valid, since 400/529 still confirms the key was accepted.

Use node.defaultModel / connection.defaultModel when set so the test
respects the configured model rather than always falling back to
claude-3-haiku-20240307.

Co-authored-by: Rehan Choirul <rehanchrl@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-20 15:53:03 +07:00
Zireael
6c10edf8ba fix(cli-tools): tolerate JSONC configs in CLI tool settings routes
readConfig/readSettings/readJson across all CLI tool settings routes used
JSON.parse() but only caught ENOENT, re-throwing SyntaxError on any
corrupted or JSONC-formatted config file. The API would return 500, which
the UI misinterpreted as "tool not installed."

This patch:
- strips trailing commas before parsing (handles JSONC from opencode, etc.)
- returns null on any parse error instead of re-throwing, so the UI shows
  "installed but not configured" (accurate) instead of "not installed"
- applies the same fix to all 8 affected routes: opencode, openclaw, kilo,
  droid, cowork, copilot, claude, and cline

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-20 15:37:01 +07:00
mustafabozkaya
f6c2f7cae3 fix(gemini): preserve 'pattern' in antigravity tool schema translation
Remove "pattern" from UNSUPPORTED_SCHEMA_CONSTRAINTS so glob/grep tool
schemas keep the required "pattern" property for the antigravity provider.

Fixes decolua/9router#1368

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-20 15:31:22 +07:00
warelik
86162eeb8f fix(combo/fusion): flatten Anthropic-style tool messages in panel calls
flattenToolHistory only recognized OpenAI-style tool calls. Anthropic-compatible clients (Claude Code, /v1/messages) send tool invocations and results as tool_use/tool_result blocks inside the message content array. Since panel calls strip the tools definitions (#1859), the panel expert models received structured tool history without schemas, causing them to fail or misbehave (leading to empty responses and 503 errors).

Extend flattenToolHistory to recognize and flatten tool_use and tool_result blocks in the content array into prose text, keeping panel expert execution robust and independent of the client API format.

PR decolua/9router#1910

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-20 15:19:31 +07:00
nguyenha935
707a91555d fix(models): store provider custom models by provider scope 2026-06-20 15:19:22 +07:00
nguyenha935
8efacc1147 feat(opencode-go): align Go models with official endpoints
Update OpenCode Go model catalog to match the official Go docs.
Route Qwen 3.7 and MiniMax models through /v1/messages with
Anthropic-compatible headers instead of OpenAI-compatible chat.
Keep GLM, Kimi, DeepSeek, and MiMo on /chat/completions; use
kimi-k2.7-code because the live Go API rejects kimi-k2.7 for chat
while the docs config example uses the code model ID.

PR #1931 by nguyenha935

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-20 15:09:11 +07:00
decolua
637dd7ae66 feat(ponytail): introduce "Ponytail" feature for minimalistic code generation 2026-06-20 15:08:11 +07:00
decolua
25e8723ad1 enhance API key management UI and improve watcher configuration. 2026-06-20 11:19:03 +07:00
decolua
090886ced9 feat(validate): implement SSRF guard for remote requests and protect sensitive settings 2026-06-20 10:41:47 +07:00
decolua
b55cf36d2e feat(headroom): add proxy lifecycle management + dashboard UI
Build on the optional Headroom Token Saver from Carmelo Campos
(PR: feat: add optional Headroom token saver). Add managed start/stop
of the local headroom proxy from the dashboard, install detection,
status probing, and a simplified Token Saver UI.

- detect headroom CLI + python>=3.10, probe proxy /health
- spawn/stop proxy as a detached, pid-tracked process
- /api/headroom/{status,start,stop} routes, gated local-only in dashboardGuard
- one-click Start/Stop Headroom modal, no manual config needed
- claude<->openai shape conversion for /v1/compress via 9router translators

Thanks to Carmelo Campos (@carmelogunsroses) for the original Headroom integration.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-20 10:09:50 +07:00
Janu Yoga
efd20be8d8 feat(provider): add CodeBuddy CN provider (copilot.tencent.com)
Add Tencent CodeBuddy CN (codebuddy-cn) OAuth provider with full support:
OAuth login (GET poll with state query param), token refresh, 15-model
catalog, /v2 inference endpoint, forced streaming, OpenAI-style reasoning,
and per-model capabilities. Renamed from codebuddy to codebuddy-cn to allow
a future codebuddy-ai variant.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-19 15:33:26 +07:00
gaoliao1688
db4499d6df fix(perplexity): use /v1/models endpoint for key validation
Perplexity deprecated /models (404); switch to /v1/models for provider
test connection and models route. (#1895, fixes #1894)

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-19 15:14:15 +07:00
decolua
126aa244c5 fix(kiro): validate region to prevent SSRF (GHSA-6mwv-4mrm-5p3m)
Reject non-AWS region values before interpolating them into upstream
URLs and stop reflecting upstream response bodies to the client.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-19 15:09:18 +07:00
1cf55126f5 fix(qoder): remove orphaned code causing build failure
Removed leftover code from incomplete edit that caused syntax error.
2026-06-19 09:40:48 +07:00
ba4ee30122 fix(qoder): detect errors in SSE envelope to trigger failover
- Made wrapQoderSSE async to peek at first chunk before streaming
- Parse first SSE line to check for error envelope (statusCodeValue !== 200)
- If error detected, return error Response with proper HTTP status code
- This triggers chatCore's !providerResponse.ok check and failover logic
- Fixes issue where qoder 403 quota errors were wrapped as successful streams

Before: qoder errors appeared as stream content with finish_reason: 'stop'
After: qoder errors return proper HTTP error codes, triggering provider failover
2026-06-19 08:47:25 +07:00
bef54d5f12 fix: merge logUsage + saveUsageStats to prevent duplicate usage stats for streaming requests
- Enhanced saveUsageStats to include cache tokens (cache_read, cache_creation), reasoning tokens, and estimated flag
- Replaced logUsage calls in stream.js with saveUsageStats (2 locations)
- Removed duplicate saveUsageStats call from streamingHandler.js onStreamComplete
- Removed logUsage function and unused imports from usageTracking.js
- Each streaming request now writes exactly 1 usage record instead of 2
2026-06-19 08:43:10 +07:00
decolua
f2a7ae2030 # v0.5.4 (2026-06-18)
## Fixes
- **Kiro**: honor thinking effort budgets
- **AG/Kiro/Xiaomi**: provider fixes
- **Combo/Fusion**: flatten tool history in panel calls to prevent 503
- **LLM selector**: show custom vision models in selector and model list
- **Image**: prevent compatible nodes from shadowing provider aliases
2026-06-18 17:46:46 +07:00
decolua
7354c5e5f4 # v0.5.3 (2026-06-18)
## Fixes
- **Kiro**: honor thinking effort budgets
- **AG/Kiro/Xiaomi**: provider fixes
- **Combo/Fusion**: flatten tool history in panel calls to prevent 503
- **LLM selector**: show custom vision models in selector and model list
- **Image**: prevent compatible nodes from shadowing provider aliases
2026-06-18 17:36:08 +07:00
EdisonPVE
2ff11246ae fix(kiro): honor thinking effort budgets
Resolve the Kiro thinking budget from client intent (OpenAI reasoning_effort,
OpenAI Responses reasoning.effort, Claude output_config.effort, and Claude
thinking.budget_tokens) by reusing the shared thinkingUnified extractThinking
parser, then inject the resolved budget into the Kiro thinking system prefix.
Explicit none/off/disabled stops the prefix injection; synthetic -thinking
aliases keep the default budget.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-18 15:14:42 +07:00
decolua
3f9382dee4 Fix AG, Kiro, Xiaomi Provider 2026-06-18 14:58:00 +07:00
WARELIK
9ab14e7714 fix(combo/fusion): flatten tool history in panel calls to prevent 503
Panel models in the fusion strategy must answer in prose. When the request
carried tools or prior tool_calls/tool messages, agentic panel models kept
emitting tool_calls instead of prose, so extractPanelText() returned empty
and the engine fell into the 503 "All fusion panel models failed" branch.

Panel fan-out now strips tools/tool_choice and flattens tool turns into
assistant prose (instead of dropping them), so panels keep the context but
cannot loop on tools. The judge still receives the unmodified history.

Co-authored-by: warelik <warelik@WARELIK-MB.local>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-18 09:55:08 +07:00
Sutarto Jordan Chrisfivo
5e5e78d3e8 fix: show custom vision models in LLM selector and model list
Expose user-added imageToText custom models as vision-capable chat
models in the default LLM selector and /v1/models, map custom service
kinds to runtime capabilities, and keep typed filtering for
/v1/models/{kind}.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-18 09:13:27 +07:00
lowkruc
047fdc8960 fix(image): prevent compatible nodes from shadowing provider aliases
Build a reserved prefix set from registry provider ids/aliases plus local
aliases, and skip compatible-node prefix matching for reserved prefixes so
built-in routes like cf/... stay on Cloudflare.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-18 09:10:52 +07:00
decolua
5da508af3c # v0.5.2 (2026-06-17)
## Features
- **Combo Fusion strategy** — fans the prompt out to all member models in parallel, then a configurable judge model synthesizes one final answer (quorum-grace, anonymized sources, graceful degradation)
- **Per-combo strategy selector** — pick `fallback` / `round-robin` / `fusion` / `capacity` per combo (replaces the old round-robin toggle), with a judge picker for fusion
- **Capacity auto-switch** — reorders models per request so images/PDFs route to capable models first
- **Kiro headless API-key auth** (`ksk_`) + direct `claude↔kiro` route that avoids the lossy OpenAI two-hop pivot
- **Claude auto-ping** — warms the 5h quota window right after reset so a fresh window starts immediately (per-connection toggle)

## Fixes
- **Claude 429**: stop hammering the OAuth usage endpoint — cache resetAt, throttle quota refresh to 3 min, cool down after a 429 (chat unaffected)
- **Usage logs always empty**: missing `await` on `getAdapter()` in `getRecentLogs` made `/api/usage/logs` & `/api/usage/request-logs` return nothing
- **Executors**: strip params unsupported by the provider/model (drops deprecated `temperature` for claude-opus-4 → Anthropic 400)
- **Translator**: derive deterministic tool_call ids for gemini/antigravity → OpenAI so function call/response pair correctly (fixes tool-pairing 400s)
- **Antigravity**: strip `optional` from tool schemas before sending to Gemini
- **Claude-to-OpenAI**: handle OpenAI-format responses in the non-streaming path (e.g. xiaomi-tokenplan)
- **Usage views**: show edited connection names consistently across Providers & Quota Tracker
- **Security**: hardened reverse-proxy local-access trust
- **Security**: SSRF hardening on web fetch

## Internal
- Large **open-sse / translator refactor** (~40 commits): unified provider/model registry (LiteLLM-style `models[]` + `kind` field, 100 co-located registry files), single-sourced media/OAuth/refresh/token URLs, registry-based dispatch for usage & token-refresh, DRY translator concerns (buildUsage, encodeDataUri, finishReasonMap, chunkBuilder, reasoningDelta…), ESM-safe registry init, large-file splits, dead-code removal, and golden/no-regression test gates
2026-06-17 11:57:17 +07:00
decolua
79df34cad7 fix: giảm spam 429 từ Claude OAuth usage endpoint
- claudeAutoPing: cache resetAt in-mem, bỏ qua poll usage cho tới gần reset
- ProviderLimits: throttle auto-refresh Claude 3 phút, nút bấm tay vẫn refresh ngay
- claude.js: 429 ở OAuth usage → cooldown 3 phút, fallback legacy (không ảnh hưởng chat)

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-17 11:42:20 +07:00
decolua
da667836cc fix(security): don't trust loopback socket as local when request arrives via reverse proxy
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-17 11:12:24 +07:00
decolua
2a619655b8 update maskKey function to enhance key visibility handling 2026-06-17 11:03:24 +07:00