Gom block SSE headers + CORS lặp ở streamingHandler + responsesHandler
vào sseConstants.SSE_HEADERS_CORS. Codex format-routing giữ nguyên
(logic-driven theo kim chỉ nam DATA/LOGIC docs 07).
Co-authored-by: Cursor <cursoragent@cursor.com>
clientId/clientSecret của antigravity + gemini bị lặp 3 nơi
(registry, usage.js, src/lib/oauth). Gom vào shared.js
(ANTIGRAVITY_OAUTH_CLIENT, GOOGLE_OAUTH_CLIENT), các file spread vào.
Byte-for-byte: PROVIDERS/alias/oauth-url equal, golden 142 pass.
Thêm test guard nội dung + alias resolution.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gộp switch 13 nhánh getUsageForProvider thành 1 registry object
(provider → handler), mỗi handler giữ nguyên signature/args qua ctx.
Behavior giữ nguyên (ollama vẫn chỉ nhận accessToken như cũ).
Thêm tests/unit/usage-dispatch.test.js guard dispatch.
Co-authored-by: Cursor <cursoragent@cursor.com>
Two `opencode` keys existed; the first (localhost:4096) was silently overridden
by the later one (opencode.ai, noAuth). Drop the dead entry. Resolved PROVIDERS
output unchanged (verified byte-for-byte).
Co-authored-by: Cursor <cursoragent@cursor.com>
CHAT_URL and opencode buildUrl base now read from PROVIDERS instead of repeating
the literal. Values identical; providers byte-for-byte + gate clean.
Co-authored-by: Cursor <cursoragent@cursor.com>
These translate-path builders had no runtime consumers: the translator route
uses executor.buildUrl/buildHeaders, and the barrel re-exports were unused.
Removing them eliminates the parallel URL/header build path (single source of
truth = executors). Drop their private helpers and the now-unused clineAuth
import. Golden executor snapshots + gate: no regression.
Co-authored-by: Cursor <cursoragent@cursor.com>
Snapshot buildProviderUrl/buildProviderHeaders/getTargetFormat for all providers
before merging the translate-path with executor URL/header builders.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add helpers/usageHelper.js for conditional prompt/completion token details.
Apply to gemini/codex/claude response translators; keep each provider's token
math intact. No behavior change; golden + gate: no regression.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add helpers/chunkBuilder.js; apply to claude/gemini/kiro/ollama/commandcode/
openai-responses response translators. Caller supplies id/created/model so each
keeps exact id-generation + usage semantics. Extend golden response stream to
openai-responses (codex). No behavior change; gate: no regression.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock current behavior before refactor: buildUrl/buildHeaders per default-executor
provider, translateResponse streaming (claude/gemini), translateRequest body
(openai->claude/gemini/kiro). Sanitize volatile fields (tokens, kimi device-id,
kiro conversationId, timestamps) for stable snapshots.
Co-authored-by: Cursor <cursoragent@cursor.com>
Features
Vercel AI Gateway: support embeddings, images and credit usage (#1183)
Add MiMo Free no-auth provider (#1789)
Vertex: support ADC authorized_user credential
Cowork: re-enable Claude Cowork with preset-only stdio MCP
Codex: bulk add accounts via JSON (#1719)
Kiro: enable multi-endpoint failover for GenerateAssistantResponse (#1722)
Fixes
Security: re-auth on DB export/import + SSRF guard on web fetch
Auth: real client IP rate-limiting + remote default-password guard
Cerebras/Mistral: strip unsupported client_metadata from downstream requests (#1742)
SiliconFlow: update baseUrl .cn → .com + curate verified model list (#1760)
Gemini-to-OpenAI: route unsigned thought parts to reasoning_content (#1752)
Claude-to-OpenAI: strip Anthropic billing header from system prompt (#1765)
Anthropic-compatible: send Bearer auth for third-party gateways (#1795)
Usage-stats: avoid partial stats on initial SSE race (#1767)
Proxy: use export default in proxy.js for Next.js 16 middleware detection
Claude passthrough: add body normalization
GitHub Copilot: refresh missing/expired token on models discovery (#1727) + add mappable gpt-5-mini/gpt-5.4-nano slots for Copilot MITM (#1653)
Kiro: auto-resolve profileArn to prevent 403 on IDC login, enhance profile ARN resolution, update endpoint to runtime.us-east-1.kiro.dev (#1713)
Tunnel: detect system-installed Tailscale via dual-socket probe (#1723) + non-blocking probes to prevent UI freeze
CommandCode: force stream=true in transformRequest (#1706)
Qoder: increase timeouts for reasoning models and improve stream handling
Dashboard: show provider node name instead of connection name in topology (#1770) + show explicit kind="llm" combos on combos page (#1684)
Docs
README: add Indonesian 9Router tutorial video (#1709)
Cerebras returns 400 (wrong_api_format) and Mistral returns 422
(extra_forbidden) when the forwarded body contains client_metadata.
Remove it for these two providers before sending downstream.
Co-authored-by: Cursor <cursoragent@cursor.com>
- /api/settings/database now requires current password (header for GET,
body for POST) in addition to session; CLI-token requests exempt
- add verifyDashboardPassword helper reusing login bcrypt check
- profile UI prompts password via modal before export/import
- /v1/web/fetch rejects internal/private/metadata targets via assertPublicUrl
Refs GHSA-qvfm-67h2-2qfx, GHSA-qj3v-64wj-q825
Co-authored-by: Cursor <cursoragent@cursor.com>
Switch all siliconflow endpoints from api.siliconflow.cn to .com (chat,
validate, test, models) — the .cn host rejected valid .com-issued keys.
Replace the model list with 13 strong models verified live against the API.
Co-authored-by: Cursor <cursoragent@cursor.com>
Skip creating partial stats from SSE before the initial REST load
completes, keeping real-time merges limited to existing full stats.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bootstrap → JWT → chat flow with auto-retry. Inject the MiMoCode
system marker required to pass the upstream 403 anti-abuse gate,
derive JWT expiry from the exp claim, and use a stable per-machine
fingerprint as the bootstrap client.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove dynamic x-anthropic-billing-header lines from Claude system prompts
when translating to OpenAI format to keep prompt prefixes stable and improve
prompt cache hits.
Co-authored-by: Cursor <cursoragent@cursor.com>
Next.js 16 requires a default export to register middleware. The named
re-export produced an empty middleware manifest, so the auth guard never
ran and the dashboard showed a white "Loading..." page.
Co-authored-by: Cursor <cursoragent@cursor.com>
Accept Google Application Default Credentials (authorized_user) in the
Vertex apiKey field as an alternative to Service Account JSON, for orgs
that block SA key creation. Refreshes a Bearer token via the existing
refreshGoogleToken flow and requires a project_id (quota_project_id or
providerSpecificData.projectId). SA JSON and raw key flows unchanged.
Co-authored-by: Cursor <cursoragent@cursor.com>
Third-party Anthropic-compatible gateways that require Authorization: Bearer
(in addition to x-api-key) returned 401 missing_api_key on the forward path.
For non-official upstreams, also send Bearer <apiKey> alongside x-api-key.
Official api.anthropic.com behavior is unchanged.
Co-authored-by: Cursor <cursoragent@cursor.com>
Restore Cowork feature while closing the RCE vector: drop user-defined
stdio commands so only hard-coded preset plugins (browsermcp) may spawn.
Custom MCP now accepts remote URL only. Routes stay gated to localhost.
Co-authored-by: Cursor <cursoragent@cursor.com>
