fix(oauth): hardcode desktop OAuth client secrets to fix build-time inlining

Next.js inlines process.env at build time, causing clientSecret defaults to
be baked as empty strings. Desktop/CLI OAuth secrets are not confidential
per Google's documentation.

Fixes: client_secret is missing error on VPS deployment

.agent/workflows/git-workflow.md

@@ -1,54 +0,0 @@
----
-description: Git workflow — NEVER commit directly to main. Always use feature branches.
----
-
-# Git Workflow
-
-## ⚠️ CRITICAL RULE: NEVER commit directly to `main`
-
-## Steps
-
-1. **Before starting any work**, create a feature branch from `main`:
-
-   ```bash
-   git checkout main && git pull origin main
-   git checkout -b feature/<feature-name>
-   ```
-
-2. **During development**, commit to the feature branch:
-
-   ```bash
-   git add -A && git commit -m "<type>(<scope>): <description>"
-   ```
-
-3. **Before pushing**, verify the build passes:
-
-   ```bash
-   npm run build
-   ```
-
-4. **When the feature is complete and verified**, push the branch and STOP:
-
-   ```bash
-   git push origin feature/<feature-name>
-   ```
-
-5. **DO NOT** create a PR, merge, or push to `main`. Let the user handle that.
-
-## Branch naming convention
-
-- `feature/<name>` — new features
-- `fix/<name>` — bugfixes
-- `refactor/<name>` — refactoring
-- `docker/<name>` — Docker / infrastructure changes
-- `style/<name>` — UI / CSS changes
-
-## Commit types
-
-- `feat` — new feature
-- `fix` — bugfix
-- `refactor` — code refactoring
-- `style` — UI / CSS changes
-- `docker` — Docker / infrastructure
-- `docs` — documentation
-- `chore` — maintenance

.env.example

@@ -44,6 +44,9 @@ REQUIRE_API_KEY=false
 BASE_URL=http://localhost:20128
 CLOUD_URL=
 # Backward-compatible/public variables:
+# NEXT_PUBLIC_BASE_URL is also used as the OAuth redirect_uri origin when running behind a
+# reverse proxy (e.g., nginx). Set this to your public-facing URL so OAuth callbacks work.
+# Example: NEXT_PUBLIC_BASE_URL=https://omniroute.example.com
 NEXT_PUBLIC_BASE_URL=http://localhost:20128
 NEXT_PUBLIC_CLOUD_URL=
 
@@ -79,17 +82,45 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Provider OAuth Credentials (optional — override hardcoded defaults)
 # These can also be set via data/provider-credentials.json
 # CLAUDE_OAUTH_CLIENT_ID=
-# GEMINI_OAUTH_CLIENT_ID=
-# GEMINI_OAUTH_CLIENT_SECRET=
+
+# ─────────────────────────────────────────────────────────────────────────────
+# ⚠️  GOOGLE OAUTH (Antigravity, Gemini CLI) — IMPORTANT FOR REMOTE SERVERS
+# ─────────────────────────────────────────────────────────────────────────────
+# The built-in Google OAuth credentials ONLY work when OmniRoute runs on
+# localhost (127.0.0.1 / local network). They are registered with
+# redirect_uri = http://localhost:PORT/callback and Google will reject any
+# other redirect URI with: redirect_uri_mismatch.
+#
+# If you are hosting OmniRoute on a remote server (VPS, Docker, cloud), you
+# MUST register your own Google Cloud OAuth 2.0 credentials:
+#
+#   1. Go to https://console.cloud.google.com/apis/credentials
+#   2. Create an OAuth 2.0 Client ID (type: "Web application")
+#   3. Add your server URL as Authorized redirect URI:
+#        https://your-server.com/callback
+#   4. Copy the Client ID and Client Secret below.
+#
+# See the full tutorial in README.md → "OAuth em Servidor Remoto" section.
+#
+# Antigravity (Google Gemini Code Assist):
+# ANTIGRAVITY_OAUTH_CLIENT_ID=your-client-id.apps.googleusercontent.com
+# ANTIGRAVITY_OAUTH_CLIENT_SECRET=GOCSPX-your-secret
+ANTIGRAVITY_OAUTH_CLIENT_SECRET=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
+
+# Gemini CLI (Google AI):
+# GEMINI_OAUTH_CLIENT_ID=your-client-id.apps.googleusercontent.com
+# GEMINI_OAUTH_CLIENT_SECRET=GOCSPX-your-secret
 # GEMINI_CLI_OAUTH_CLIENT_ID=
-# GEMINI_CLI_OAUTH_CLIENT_SECRET=
+GEMINI_OAUTH_CLIENT_SECRET=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
+GEMINI_CLI_OAUTH_CLIENT_SECRET=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
+# ─────────────────────────────────────────────────────────────────────────────
+
+# CLAUDE_OAUTH_CLIENT_ID=
 # CODEX_OAUTH_CLIENT_ID=
 # CODEX_OAUTH_CLIENT_SECRET=
 # QWEN_OAUTH_CLIENT_ID=
 # IFLOW_OAUTH_CLIENT_ID=
-# IFLOW_OAUTH_CLIENT_SECRET=
-# ANTIGRAVITY_OAUTH_CLIENT_ID=
-# ANTIGRAVITY_OAUTH_CLIENT_SECRET=
+IFLOW_OAUTH_CLIENT_SECRET=4Z3YjXycVsQvyGF1etiNlIBB4RsqSDtW
 
 # API Key Providers (Phase 1 + Phase 4)
 # Add via Dashboard → Providers → Add API Key, or set here
@@ -118,3 +149,7 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Logging
 # LOG_LEVEL=info
 # LOG_FORMAT=text
+LOG_TO_FILE=true
+# LOG_FILE_PATH=logs/application/app.log
+# LOG_MAX_FILE_SIZE=50M
+# LOG_RETENTION_DAYS=7

.github/workflows/ci.yml

@@ -36,7 +36,8 @@ jobs:
       - name: Dependency audit
         run: npm audit --audit-level=high --omit=dev
       - name: Check for known vulnerabilities
-        run: npx is-my-node-vulnerable || true
+        run: npx is-my-node-vulnerable
+        continue-on-error: true
 
   build:
     name: Build
@@ -108,3 +109,39 @@ jobs:
       - run: npx playwright install --with-deps chromium
       - run: npm run build
       - run: npm run test:e2e
+
+  test-integration:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    needs: build
+    env:
+      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-test-api-key-secret-long
+      INITIAL_PASSWORD: ci-test-password-for-integration
+      DATA_DIR: /tmp/omniroute-ci
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run test:integration
+        continue-on-error: true
+
+  test-security:
+    name: Security Tests
+    runs-on: ubuntu-latest
+    needs: build
+    env:
+      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-test-api-key-secret-long
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run test:security
+        continue-on-error: true

.github/workflows/deploy-vps.yml

@@ -0,0 +1,44 @@
+name: Deploy to VPS
+
+on:
+  workflow_run:
+    workflows: ["Publish to Docker Hub"]
+    types: [completed]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+    name: Deploy OmniRoute to VPS
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Tailscale
+        uses: tailscale/github-action@v3
+        with:
+          oauth-client-id: ""
+          oauth-secret: ""
+          tags: tag:ci-deploy
+        continue-on-error: true
+
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USER }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          port: 22
+          timeout: 30s
+          script: |
+            echo "=== Updating OmniRoute ==="
+            npm install -g omniroute@latest 2>&1
+            INSTALLED_VERSION=$(omniroute --version 2>/dev/null || echo "unknown")
+            echo "Installed version: $INSTALLED_VERSION"
+
+            echo "=== Restarting PM2 ==="
+            pm2 restart omniroute || pm2 start omniroute --name omniroute -- --port 20128
+            pm2 save
+
+            echo "=== Health Check ==="
+            sleep 3
+            curl -sf http://localhost:20128/api/settings > /dev/null && echo "✅ OmniRoute is healthy" || echo "❌ Health check failed"
+            echo "=== Deploy complete ==="

.gitignore

@@ -94,3 +94,5 @@ security-analysis/
 
 # Deploy workflow (contains sensitive VPS credentials)
 .agent/workflows/deploy.md
+clipr/
+app.log

CHANGELOG.md

@@ -7,6 +7,414 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.4.2] — 2026-02-23
+
+### 🐛 Bug Fix
+
+- **OAuth Token Refresh** — Fixed `client_secret is missing` error for Google-based OAuth providers (Antigravity, Gemini, Gemini CLI, iFlow). Desktop/CLI OAuth secrets are now hardcoded as defaults since Next.js inlined empty strings at build time.
+
+---
+
+## [1.4.1] — 2026-02-23
+
+### 🔧 Improvements
+
+- **Endpoint Page Cleanup** — Removed redundant API Key Management section from Endpoint page (now fully managed in the dedicated API Manager page)
+- **CI/CD** — Added `deploy-vps.yml` workflow for automatic VPS deployment on new releases
+
+---
+
+## [1.4.0] — 2026-02-23
+
+> ### ✨ Feature Release — Dedicated API Key Manager with Model Permissions
+>
+> Community-contributed API Key Manager page with model-level access control, enhanced with usage statistics, key status indicators, and improved UX.
+
+### ✨ New Features
+
+- **Dedicated API Key Manager** — New `/dashboard/api-manager` page for managing API keys, extracted from the Endpoint page. Includes create, delete, and permissions management with a clean table UI ([PR #118](https://github.com/diegosouzapw/OmniRoute/pull/118) by [@nyatoru](https://github.com/nyatoru))
+- **Model-Level API Key Permissions** — Restrict API keys to specific models using `allowed_models` with wildcard pattern support (e.g., `openai/*`). Toggle between "Allow All" and "Restrict" modes with an intuitive provider-grouped model selector
+- **API Key Validation Cache** — 3-tier caching layer (validation, metadata, permission) reduces database hits on every request, with automatic cache invalidation on key changes
+- **Usage Statistics Per Key** — Each API key shows total request count and last used timestamp, with a stats summary dashboard (total keys, restricted keys, total requests, models available)
+- **Key Status Indicators** — Color-coded lock/unlock icons and copy buttons on each key row for quick identification of restricted vs unrestricted keys
+
+### 🔧 Improvements
+
+- **Endpoint Page Simplified** — API key management removed from Endpoint page and replaced with a prominent link to the API Manager
+- **Sidebar Navigation** — New "API Manager" entry with `vpn_key` icon in the sidebar
+- **Prepared Statements** — API key database operations now use cached prepared statements for better performance
+- **Input Validation** — XSS-safe sanitization and regex validation for key names; ID format validation for API calls
+
+---
+
+## [1.3.1] — 2026-02-23
+
+> ### 🐛 Bugfix Release — Proxy Connection Tests & Compatible Provider Display
+>
+> Fixes provider connection tests bypassing configured proxy and improves compatible provider display in the request logger.
+
+### 🐛 Bug Fixes
+
+- **Connection Tests Now Use Proxy** — Provider connection tests (`Test Connection` button) now route through the configured proxy (key → combo → provider → global → direct), matching the behavior of real API calls. Previously, `fetch()` was called directly, bypassing the proxy entirely ([#119](https://github.com/diegosouzapw/OmniRoute/issues/119))
+- **Compatible Provider Display in Logs** — OpenAI/Anthropic compatible providers now show friendly labels (`OAI-COMPAT`, `ANT-COMPAT`) instead of raw UUID-based IDs in the request logger's provider column, dropdown, and quick filters ([#113](https://github.com/diegosouzapw/OmniRoute/issues/113))
+
+### 🧪 Tests
+
+- **Connection Test Unit Tests** — 26 new test cases covering error classification logic, token expiry detection, and provider display label resolution
+
+---
+
+## [1.3.0] — 2026-02-23
+
+> ### ✨ Feature Release — iFlow Fix, Health Check Logs Toggle, Kilocode Models & Model Deduplication
+>
+> Community-driven release with iFlow HMAC-SHA256 signature support, health check log management, expanded Kilocode model list, and model deduplication on the dashboard.
+
+### ✨ New Features
+
+- **Hide Health Check Logs** — New toggle in Settings → Appearance to suppress verbose `[HealthCheck]` messages from the server console. Uses a 30-second cache to minimize database reads with request coalescing for concurrent calls ([PR #111](https://github.com/diegosouzapw/OmniRoute/pull/111) by [@nyatoru](https://github.com/nyatoru))
+- **Kilocode Custom Models Endpoint** — Added `modelsUrl` support in `RegistryEntry` for providers with non-standard model endpoints. Expanded Kilocode model list from 8 to 26 models including Qwen3, GPT-5, Claude 3 Haiku, Gemini 2.5, DeepSeek V3, Llama 4, and more ([PR #115](https://github.com/diegosouzapw/OmniRoute/pull/115) by [@benzntech](https://github.com/benzntech))
+
+### 🐛 Bug Fixes
+
+- **iFlow 406 Error** — Created dedicated `IFlowExecutor` with HMAC-SHA256 signature support (`session-id`, `x-iflow-timestamp`, `x-iflow-signature` headers). The iFlow provider was previously using the default executor which lacked the required signature headers, causing 406 errors ([#114](https://github.com/diegosouzapw/OmniRoute/issues/114))
+- **Duplicate Models in Endpoint Lists** — Filtered out parent models (`!m.parent`) from all model categorization and count logic on the Endpoint page. Provider modal lists also exclude duplicates ([PR #112](https://github.com/diegosouzapw/OmniRoute/pull/112) by [@nyatoru](https://github.com/nyatoru))
+
+### 🧪 Tests
+
+- **IFlowExecutor Unit Tests** — 11 new test cases covering HMAC-SHA256 signature generation, header building, URL construction, body passthrough, and executor registry integration
+
+---
+
+## [1.2.0] — 2026-02-22
+
+> ### ✨ Feature Release — Dashboard Session Auth for Models Endpoint
+>
+> Dashboard users can now access `/v1/models` via their existing session when API key auth is required.
+
+### ✨ New Features
+
+- **JWT Session Auth Fallback** — When `requireAuthForModels` is enabled, the `/v1/models` endpoint now accepts both API key (Bearer token) for external clients **and** the dashboard JWT session cookie (`auth_token`), allowing logged-in dashboard users to view models without needing an explicit API key ([PR #110](https://github.com/diegosouzapw/OmniRoute/pull/110) by [@nyatoru](https://github.com/nyatoru))
+
+### 🔧 Improvements
+
+- **401 instead of 404** — Authentication failures on `/v1/models` now return `401 Unauthorized` with a structured JSON error body (OpenAI-compatible format) instead of a generic `404 Not Found`, improving debuggability for API clients
+- **Simplified auth logic** — Refactored the JWT cookie verification to reuse the same pattern as `apiAuth.ts`, removing redundant same-origin detection (~60 lines) since the `sameSite:lax` + `httpOnly` cookie flags already provide equivalent CSRF protection
+
+---
+
+## [1.1.1] — 2026-02-22
+
+> ### 🐛 Bugfix Release — API Key Creation & Codex Team Plan Quotas
+>
+> Fixes API key creation crash when `API_KEY_SECRET` is not set and adds Code Review rate limit window to Codex quota display.
+
+### 🐛 Bug Fixes
+
+- **API Key Creation** — Added deterministic fallback for `API_KEY_SECRET` to prevent `crypto.createHmac` crash when the environment variable is not configured. Keys created without the secret are insecure (warned at startup) but the application no longer crashes ([#108](https://github.com/diegosouzapw/OmniRoute/issues/108))
+- **Codex Code Review Quota** — Added parsing of the third rate limit window (`code_review_rate_limit`) from the ChatGPT usage API, supporting Plus/Pro/Team plan differences. The dashboard now displays all three quota bars: Session (5h), Weekly, and Code Review ([#106](https://github.com/diegosouzapw/OmniRoute/issues/106))
+
+---
+
+## [1.1.0] — 2026-02-21
+
+> ### 🐛 Bugfix Release — OAuth Client Secret and Codex Business Quotas
+>
+> Fixes missing remote-server OAuth configurations and adds ChatGPT Business account quota monitoring.
+
+### 🐛 Bug Fixes
+
+- **OAuth Client Secret** — Omitted explicitly empty `client_secret` parameters to resolve token exchange connection rejection on remote servers missing environment variables for Antigravity, Gemini and iFlow ([#103](https://github.com/diegosouzapw/OmniRoute/issues/103))
+- **Codex Business Quotas** — Automatically fetches the appropriate ChatGPT workspace to unlock the 5-hour Business usage limits directly inside the Quota tab and mapped `BIZ` string variant perfectly ([#101](https://github.com/diegosouzapw/OmniRoute/issues/101))
+
+---
+
+## [1.0.10] — 2026-02-21
+
+> ### 🐛 Bugfix — Multi-Account Support for Qwen
+>
+> Solves the issue where adding a second Qwen account would overwrite the first one.
+
+### 🐛 Bug Fixes
+
+- **OAuth Accounts** — Extracted user email from the `id_token` using JWT decoding for Qwen and similar providers, allowing multiple accounts of the same provider to be authenticated simultaneously instead of triggering the fallback overwrite logic ([#99](https://github.com/diegosouzapw/OmniRoute/issues/99))
+
+---
+
+## [1.0.9] — 2026-02-21
+
+> ### 🐛 Hotfix — Settings Persistence
+>
+> Fixes blocked providers and API auth toggle not being saved after page reload.
+
+### 🐛 Bug Fixes
+
+- **Settings Persistence** — Added `requireAuthForModels` (boolean) and `blockedProviders` (string array) to the Zod validation schema, which was silently stripping these fields during PATCH requests, preventing them from being saved to the database
+
+---
+
+## [1.0.8] — 2026-02-21
+
+> ### 🔒 API Security & Windows Support
+>
+> Adds API Endpoint Protection for `/models`, Windows server startup fixes, and UI improvements.
+
+### ✨ New Features
+
+- **API Endpoint Protection (`/models`)** — New Security Tab settings to optionally require an API key for the `/v1/models` endpoint (returns 404 when unauthorized) and to selectively block specific providers from appearing in the models list ([#100](https://github.com/diegosouzapw/OmniRoute/issues/100), [#96](https://github.com/diegosouzapw/OmniRoute/issues/96))
+- **Interactive Provider UI** — Blocked Providers setting features an interactive chip selector with visual badges for all available AI providers
+
+### 🐛 Bug Fixes
+
+- **Windows Server Startup** — Fixed `ERR_INVALID_FILE_URL_PATH` crash on Windows by safely wrapping `import.meta.url` resolution with a fallback to `process.cwd()` for globally installed npm packages ([#98](https://github.com/diegosouzapw/OmniRoute/issues/98))
+- **Combo buttons visibility** — Fixed layout overlap and tight spacing for the Quick Action buttons (Clone / Delete / Test) on the Combos page on narrower screens ([#95](https://github.com/diegosouzapw/OmniRoute/issues/95))
+
+---
+
+## [1.0.7] — 2026-02-20
+
+> ### 🐛 Bugfix Release — OpenAI Compatibility, Custom Models & OAuth UX
+>
+> Fixes three community-reported issues: stream default now follows OpenAI spec, custom OpenAI-compatible providers appear in `/v1/models`, and Google OAuth shows a clear error + tutorial for remote deployments.
+
+### 🐛 Bug Fixes
+
+- **`stream` defaults to `false`** — Aligns with the OpenAI specification which explicitly states `stream` defaults to `false`. Previously OmniRoute defaulted to `true`, causing SSE data to be returned instead of a JSON object, breaking clients like Spacebot, OpenCode, and standard Python/Rust/Go OpenAI SDKs that don't explicitly set `stream: true` ([#89](https://github.com/diegosouzapw/OmniRoute/issues/89))
+- **Custom AI providers now appear in `/v1/models`** — OpenAI-compatible custom providers (e.g. FriendLI) whose provider ID wasn't in the built-in alias map were silently excluded from the models list even when active. Fixed by also checking the raw provider ID from the database against active connections ([#90](https://github.com/diegosouzapw/OmniRoute/issues/90))
+- **OAuth `redirect_uri_mismatch` — improved UX for remote deployments** — Google OAuth providers (Antigravity, Gemini CLI) now always use `localhost` as redirect URI matching the registered credentials. Remote-access users see a targeted amber warning with a link to the new setup guide. The token exchange error message explains the root cause and guides users to configure their own credentials ([#91](https://github.com/diegosouzapw/OmniRoute/issues/91))
+
+### 📖 Documentation
+
+- **OAuth em Servidor Remoto tutorial** — New README section with step-by-step guide to configure custom Google Cloud OAuth 2.0 credentials for remote/VPS/Docker deployments
+- **`.env.example` Google OAuth block** — Added prominent warning block explaining remote credential requirements with direct links to Google Cloud Console
+
+### 📁 Files Modified
+
+| File                                   | Change                                                                                      |
+| -------------------------------------- | ------------------------------------------------------------------------------------------- |
+| `open-sse/handlers/chatCore.ts`        | `stream` defaults to `false` (was `true`) per OpenAI spec                                   |
+| `src/app/api/v1/models/route.ts`       | Added raw `providerId` check for custom models active-provider filter                       |
+| `src/shared/components/OAuthModal.tsx` | Force `localhost` redirect for Google OAuth; improved `redirect_uri_mismatch` error message |
+| `.env.example`                         | Added ⚠️ Google OAuth remote credentials block with step-by-step instructions               |
+| `README.md`                            | New "🔐 OAuth em Servidor Remoto" tutorial section                                          |
+
+---
+
+## [1.0.6] — 2026-02-20
+
+> ### ✨ Provider & Combo Toggles — Strict Model Filtering
+>
+> `/v1/models` now shows only models from providers with active connections. Combos and providers can be toggled on/off directly from the dashboard.
+
+### ✨ New Features
+
+- **Provider toggle on Providers page** — Enable/disable all connections for a provider directly from the main Providers list. Toggle is always visible, no hover needed
+- **Combo enable/disable toggle** — Each combo on the Combos page now has a toggle. Disabled combos are excluded from `/v1/models`
+- **OAuth private IP support** — Expanded localhost detection to include private/LAN IPs (`192.168.x.x`, `10.x.x.x`, `172.16-31.x.x`) for correct OAuth redirect URIs
+
+### 🐛 Bug Fixes
+
+- **`/v1/models` strict filtering** — Models are now shown only from providers with active, enabled connections. Previously, if no connections existed or all were disabled, all 378+ models were shown as a fallback
+- **Disabled provider models hidden** — Toggling off a provider immediately removes its models from `/v1/models`
+
+---
+
+## [1.0.5] — 2026-02-20
+
+> ### 🐛 Hotfix — Model Filtering & Docker DATA_DIR
+>
+> Filters all model types in `/v1/models` by active providers and fixes Docker data directory mismatch.
+
+### 🐛 Bug Fixes
+
+- **`/v1/models` full filtering** — Embedding, image, rerank, audio, and moderation models are now filtered by active provider connections, matching chat model behavior. Providers like Together AI no longer appear without a configured API key (#88)
+- **Docker `DATA_DIR`** — Added `ENV DATA_DIR=/app/data` to Dockerfile and `docker-compose.yml` ensuring the volume mount always matches the app data directory — prevents empty database on container recreation
+
+---
+
+## [1.0.4] — 2026-02-19
+
+> ### 🔧 Provider Filtering, OAuth Proxy Fix & Documentation
+>
+> Dashboard model filtering by active providers, provider enable/disable visual indicators, OAuth login fix for nginx reverse proxy, and LLM onboarding documentation.
+
+### ✨ Features
+
+- **API Models filtering** — `GET /api/models` now returns only models from active providers; use `?all=true` for all models (#85)
+- **Provider disabled indicator** — Provider cards show ⏸ "Disabled" badge with reduced opacity when all connections are inactive (#85)
+- **`llm.txt`** — Comprehensive LLM onboarding file with project overview, architecture, flows, and conventions (#84)
+- **WhatsApp Community** — Added WhatsApp group link to README badges and Support section
+
+### 🐛 Bug Fixes
+
+- **OAuth behind nginx** — Fixed OAuth login failing when behind a reverse proxy by using `window.location.origin` for redirect URI instead of hardcoded `localhost` (#86)
+- **`NEXT_PUBLIC_BASE_URL` for OAuth** — Documented env var usage as redirect URI override for proxy deployments (#86)
+
+### 📁 Files Added
+
+| File      | Purpose                                            |
+| --------- | -------------------------------------------------- |
+| `llm.txt` | LLM and contributor onboarding (llms.txt standard) |
+
+### 📁 Files Modified
+
+| File                                               | Change                                                           |
+| -------------------------------------------------- | ---------------------------------------------------------------- |
+| `src/app/api/models/route.ts`                      | Filter by active providers, `?all=true` param, `available` field |
+| `src/app/(dashboard)/dashboard/providers/page.tsx` | `allDisabled` detection + ⏸ badge + opacity-50 on provider cards |
+| `src/shared/components/OAuthModal.tsx`             | Proxy-aware redirect URI using `window.location.origin`          |
+| `.env.example`                                     | Documented `NEXT_PUBLIC_BASE_URL` for OAuth behind proxy         |
+
+---
+
+## [1.0.3] — 2026-02-19
+
+> ### 📊 Logs Dashboard & Real-Time Console Viewer
+>
+> Unified logs interface with real-time console log viewer, file-based logging via console interception, and server initialization improvements.
+
+### ✨ Features
+
+- **Logs Dashboard** — Consolidated 4-tab page at `/dashboard/logs` with Request Logs, Proxy Logs, Audit Logs, and Console tabs
+- **Console Log Viewer** — Terminal-style real-time log viewer with color-coded log levels, auto-scroll, search/filtering, level filter, and 5-second polling
+- **Console Interceptor** — Monkey-patches `console.log/info/warn/error/debug` at server start to capture all application output as JSON lines to `logs/application/app.log`
+- **Log Rotation** — Size-based rotation and retention-based cleanup for log files
+
+### 🔧 Improvements
+
+- **Instrumentation consolidation** — Moved `initAuditLog()`, `cleanupExpiredLogs()`, and console interceptor initialization to Next.js `instrumentation.ts` (runs on both dev and prod server start)
+- **Structured Logger file output** — `structuredLogger.ts` now also appends JSON log entries to the log file
+- **Pino Logger fix** — Fixed broken mix of pino `transport` targets + manual `createWriteStream`; now uses `pino/file` transport targets exclusively with absolute paths
+
+### 🗂️ Files Added
+
+| File                                                 | Purpose                                                           |
+| ---------------------------------------------------- | ----------------------------------------------------------------- |
+| `src/app/(dashboard)/dashboard/logs/page.tsx`        | Tabbed Logs Dashboard page                                        |
+| `src/app/(dashboard)/dashboard/logs/AuditLogTab.tsx` | Audit log tab component extracted from standalone page            |
+| `src/shared/components/ConsoleLogViewer.tsx`         | Terminal-style real-time log viewer                               |
+| `src/app/api/logs/console/route.ts`                  | API endpoint to read log file (filters last 1h, level, component) |
+| `src/lib/consoleInterceptor.ts`                      | Console method monkey-patching for file capture                   |
+| `src/lib/logRotation.ts`                             | Log rotation by size and cleanup by retention days                |
+
+### 🗂️ Files Modified
+
+| File                                    | Change                                                                          |
+| --------------------------------------- | ------------------------------------------------------------------------------- |
+| `src/shared/components/Sidebar.tsx`     | Nav: "Request Logs" → "Logs" with `description` icon                            |
+| `src/shared/components/Breadcrumbs.tsx` | Added breadcrumb labels for `logs`, `audit-log`, `console`                      |
+| `src/instrumentation.ts`                | Added console interceptor + audit log init + expired log cleanup                |
+| `src/server-init.ts`                    | Added console interceptor import (backup init)                                  |
+| `src/shared/utils/logger.ts`            | Fixed pino file transport using `pino/file` targets                             |
+| `src/shared/utils/structuredLogger.ts`  | Added `appendFileSync` file writing + log file config                           |
+| `.env.example`                          | Added `LOG_TO_FILE`, `LOG_FILE_PATH`, `LOG_MAX_FILE_SIZE`, `LOG_RETENTION_DAYS` |
+
+### ⚙️ Configuration
+
+New environment variables:
+
+| Variable             | Default                    | Description                   |
+| -------------------- | -------------------------- | ----------------------------- |
+| `LOG_TO_FILE`        | `true`                     | Enable/disable file logging   |
+| `LOG_FILE_PATH`      | `logs/application/app.log` | Log file path                 |
+| `LOG_MAX_FILE_SIZE`  | `50M`                      | Max file size before rotation |
+| `LOG_RETENTION_DAYS` | `7`                        | Days to retain old log files  |
+
+---
+
+## [1.0.2] — 2026-02-18
+
+> ### 🔒 Security Hardening, Architecture Improvements & UX Polish
+>
+> Comprehensive audit-driven improvements across security, architecture, testing, and user experience.
+
+### 🛡️ Security (Phase 0)
+
+- **Auth guard** — API route protection via `withAuth` middleware for all dashboard routes
+- **CSRF protection** — Token-based CSRF guard for all state-changing API routes
+- **Request payload validation** — Zod schemas for provider, combo, key, and settings endpoints
+- **Prompt injection guard** — Input sanitization against malicious prompt patterns
+- **Body size guard** — Route-specific body size limits with dedicated audio upload threshold
+- **Rate limiter** — Per-IP rate limiting with configurable windows and thresholds
+
+### 🏗️ Architecture (Phase 1–2)
+
+- **DI container** — Simple dependency injection container for service registration
+- **Policy engine** — Consolidated `PolicyEngine` for routing, security, and rate limiting
+- **SQLite migration** — Database migration system with versioned migration runner
+- **Graceful shutdown** — Clean server shutdown with connection draining
+- **TypeScript fixes** — Resolved all `tsc` errors; removed redundant `@ts-check` directives
+- **Pipeline decomposition** — `handleSingleModelChat` decomposed into composable pipeline stages
+- **Prompt template versioning** — Version-tracked prompt templates with rollback support
+- **Eval scheduling** — Automated evaluation suite scheduling with cron-based runner
+- **Plugin architecture** — Extensible plugin system for custom middleware and handlers
+
+### 🧪 Testing & CI (Phase 2)
+
+- **Coverage thresholds** — Jest coverage thresholds enforced in CI (368 tests passing)
+- **Proxy pipeline integration tests** — End-to-end tests for the proxy request pipeline
+- **CI audit workflow** — npm audit and security scanning in GitHub Actions
+- **k6 load tests** — Performance testing with ramping VUs and custom metrics
+
+### ✨ UX & Polish (Phase 3–4)
+
+- **Session management** — Session info card with login time, age, user agent, and logout
+- **Focus indicators** — Global `:focus-visible` styles and `--focus-ring` CSS utility
+- **Audit log viewer** — Security event audit log with structured data display
+- **Dashboard cleanup** — Removed unused files, fixed Quick Start links to Endpoint page
+- **Documentation** — Troubleshooting guide, deployment improvements
+
+---
+
+## [1.0.1] — 2026-02-18
+
+> ### 🔧 API Compatibility & SDK Hardening
+>
+> Response sanitization, role normalization, and structured output improvements for strict OpenAI SDK compatibility and cross-provider robustness.
+
+### 🛡️ Response Sanitization (NEW)
+
+- **Response sanitizer module** — New `responseSanitizer.ts` strips non-standard fields (`x_groq`, `usage_breakdown`, `service_tier`, etc.) from all OpenAI-format provider responses, fixing OpenAI Python SDK v1.83+ Pydantic validation failures that returned raw strings instead of parsed `ChatCompletion` objects
+- **Streaming chunk sanitization** — Passthrough streaming mode now sanitizes each SSE chunk in real-time via `sanitizeStreamingChunk()`, ensuring strict `chat.completion.chunk` schema compliance
+- **ID/Object/Usage normalization** — Ensures `id`, `object`, `created`, `model`, `choices`, and `usage` fields always exist with correct types
+- **Usage field cleanup** — Strips non-standard usage sub-fields, keeps only `prompt_tokens`, `completion_tokens`, `total_tokens`, and OpenAI detail fields
+
+### 🧠 Think Tag Extraction (NEW)
+
+- **`<think>` tag extraction** — Automatically extracts `<think>...</think>` blocks from thinking model responses (DeepSeek R1, Kimi K2 Thinking, etc.) into OpenAI's standard `reasoning_content` field
+- **Streaming think-tag stripping** — Real-time `<think>` extraction in passthrough SSE stream, preventing JSON parsing errors in downstream tools
+- **Preserves native reasoning** — Providers that already send `reasoning_content` natively (e.g., OpenAI o1) are not overwritten
+
+### 🔄 Role Normalization (NEW)
+
+- **`developer` → `system` conversion** — OpenAI's new `developer` role is automatically converted to `system` for all non-OpenAI providers (Claude, Gemini, Kiro, etc.)
+- **`system` → `user` merging** — For models that reject the `system` role (GLM, ERNIE), system messages are intelligently merged into the first user message with clear delimiters
+- **Model-aware normalization** — Uses model name prefix matching (`glm-*`, `ernie-*`) for compatibility decisions, avoiding hardcoded provider-level flags
+
+### 📐 Structured Output for Gemini (NEW)
+
+- **`response_format` → Gemini conversion** — OpenAI's `json_schema` structured output is now translated to Gemini's `responseMimeType` + `responseSchema` in the translator pipeline
+- **`json_object` support** — `response_format: { type: "json_object" }` maps to Gemini's `application/json` MIME type
+- **Schema cleanup** — Automatically removes unsupported JSON Schema keywords (`$schema`, `additionalProperties`) for Gemini compatibility
+
+### 📁 Files Added
+
+| File                                     | Purpose                                                                |
+| ---------------------------------------- | ---------------------------------------------------------------------- |
+| `open-sse/handlers/responseSanitizer.ts` | Response field stripping, think-tag extraction, ID/usage normalization |
+| `open-sse/services/roleNormalizer.ts`    | Developer→system, system→user role conversion pipeline                 |
+
+### 📁 Files Modified
+
+| File                                              | Change                                                                          |
+| ------------------------------------------------- | ------------------------------------------------------------------------------- |
+| `open-sse/handlers/chatCore.ts`                   | Integrated response sanitizer for non-streaming OpenAI responses                |
+| `open-sse/utils/stream.ts`                        | Integrated streaming chunk sanitizer + think-tag extraction in passthrough mode |
+| `open-sse/translator/index.ts`                    | Integrated role normalizer into the request translation pipeline                |
+| `open-sse/translator/request/openai-to-gemini.ts` | Added `response_format` → `responseMimeType`/`responseSchema` conversion        |
+
+---
+
 ## [1.0.0] — 2026-02-18
 
 > ### 🎉 First Major Release — OmniRoute 1.0
@@ -138,4 +546,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+[1.3.0]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.3.0
+[1.2.0]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.2.0
+[1.1.1]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.1.1
+[1.0.7]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.7
+[1.0.6]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.6
+[1.0.5]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.5
+[1.0.4]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.4
+[1.1.0]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.1.0
+[1.0.1]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.1
+[1.0.3]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.3
+[1.0.2]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.2
 [1.0.0]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.0

CONTRIBUTING.md

@@ -159,7 +159,7 @@ src/                        # TypeScript (.ts / .tsx)
 │   ├── cacheLayer.ts       # LRU cache
 │   ├── semanticCache.ts    # Semantic response cache
 │   ├── idempotencyLayer.ts # Request deduplication
-│   └── localDb.ts          # LowDB (JSON) storage
+│   └── localDb.ts          # Settings facade (LowDB for config, SQLite for domain data)
 ├── shared/
 │   ├── components/         # React components (.tsx)
 │   ├── middleware/          # Correlation IDs, etc.

Dockerfile

@@ -20,7 +20,8 @@ ENV NODE_ENV=production
 ENV PORT=20128
 ENV HOSTNAME=0.0.0.0
 
-# Runtime writable location for localDb when DATA_DIR is configured to /app/data
+# Data directory inside Docker — must match the volume mount in docker-compose.yml
+ENV DATA_DIR=/app/data
 RUN mkdir -p /app/data
 
 COPY --from=builder /app/public ./public

README.de.md

@@ -100,6 +100,7 @@ _Verbinde jedes KI-gesteuerte IDE- oder CLI-Tool über OmniRoute — kostenloses
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
 [![License](https://img.shields.io/github/license/diegosouzapw/OmniRoute)](https://github.com/diegosouzapw/OmniRoute/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
+[![WhatsApp](https://img.shields.io/badge/WhatsApp-Community-25D366?logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 
 [🌐 Website](https://omniroute.online) • [🚀 Schnellstart](#-schnellstart) • [💡 Funktionen](#-hauptfunktionen) • [📖 Doku](#-dokumentation) • [💰 Preise](#-preisübersicht)
 
@@ -242,7 +243,7 @@ docker compose --profile cli up -d
 | Image                    | Tag      | Größe  | Beschreibung             |
 | ------------------------ | -------- | ------ | ------------------------ |
 | `diegosouzapw/omniroute` | `latest` | ~250MB | Letztes stabiles Release |
-| `diegosouzapw/omniroute` | `1.0.0`  | ~250MB | Aktuelle Version         |
+| `diegosouzapw/omniroute` | `1.0.6`  | ~250MB | Aktuelle Version         |
 
 ---
 
@@ -892,7 +893,7 @@ Das vorgeladene „OmniRoute Golden Set" enthält 10 Testfälle:
 **Verbindungstest zeigt „Invalid" für OpenAI-kompatible Anbieter**
 
 - Viele Anbieter stellen den `/models` Endpoint nicht bereit
-- OmniRoute v1.0.0+ enthält Fallback-Validierung via Chat Completions
+- OmniRoute v1.0.6+ enthält Fallback-Validierung via Chat Completions
 - Stelle sicher, dass die Base URL den `/v1` Suffix enthält
 
 </details>
@@ -902,7 +903,7 @@ Das vorgeladene „OmniRoute Golden Set" enthält 10 Testfälle:
 ## 🛠️ Technologie-Stack
 
 - **Runtime**: Node.js 20+
-- **Sprache**: TypeScript 5.9 — **100% TypeScript** in `src/` und `open-sse/` (v1.0.0)
+- **Sprache**: TypeScript 5.9 — **100% TypeScript** in `src/` und `open-sse/` (v1.0.6)
 - **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
 - **Datenbank**: LowDB (JSON) + SQLite (Domain-Status + Proxy-Logs)
 - **Streaming**: Server-Sent Events (SSE)
@@ -932,9 +933,13 @@ Das vorgeladene „OmniRoute Golden Set" enthält 10 Testfälle:
 
 ## 📧 Support
 
+> 💬 **Treten Sie unserer Community bei!** [WhatsApp-Gruppe](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) — Hilfe bekommen, Tipps teilen und auf dem Laufenden bleiben.
+
 - **Website**: [omniroute.online](https://omniroute.online)
 - **GitHub**: [github.com/diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
 - **Issues**: [github.com/diegosouzapw/OmniRoute/issues](https://github.com/diegosouzapw/OmniRoute/issues)
+- **WhatsApp**: [Community-Gruppe](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
+- **WhatsApp**: [Community-Gruppe](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 - **Originalprojekt**: [9router von decolua](https://github.com/decolua/9router)
 
 ---
@@ -957,7 +962,7 @@ Siehe [CONTRIBUTING.md](CONTRIBUTING.md) für detaillierte Richtlinien.
 
 ```bash
 # Release erstellen — npm-Veröffentlichung erfolgt automatisch
-gh release create v1.0.0 --title "v1.0.0" --generate-notes
+gh release create v1.0.6 --title "v1.0.6" --generate-notes
 ```
 
 ---

README.es.md

@@ -100,6 +100,7 @@ _Conecta cualquier IDE o herramienta CLI con IA a través de OmniRoute — gatew
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
 [![License](https://img.shields.io/github/license/diegosouzapw/OmniRoute)](https://github.com/diegosouzapw/OmniRoute/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
+[![WhatsApp](https://img.shields.io/badge/WhatsApp-Community-25D366?logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 
 [🌐 Website](https://omniroute.online) • [🚀 Inicio Rápido](#-inicio-rápido) • [💡 Características](#-características-principales) • [📖 Docs](#-documentación) • [💰 Precios](#-precios-resumidos)
 
@@ -242,7 +243,7 @@ docker compose --profile cli up -d
 | Imagen                   | Tag      | Tamaño | Descripción            |
 | ------------------------ | -------- | ------ | ---------------------- |
 | `diegosouzapw/omniroute` | `latest` | ~250MB | Última versión estable |
-| `diegosouzapw/omniroute` | `1.0.0`  | ~250MB | Versión actual         |
+| `diegosouzapw/omniroute` | `1.0.6`  | ~250MB | Versión actual         |
 
 ---
 
@@ -892,7 +893,7 @@ El "OmniRoute Golden Set" precargado contiene 10 casos de prueba que cubren:
 **Prueba de conexión muestra "Invalid" para proveedores compatibles con OpenAI**
 
 - Muchos proveedores no exponen el endpoint `/models`
-- OmniRoute v1.0.0+ incluye validación vía chat completions como fallback
+- OmniRoute v1.0.6+ incluye validación vía chat completions como fallback
 - Asegúrate de que la URL base incluya el sufijo `/v1`
 
 </details>
@@ -902,7 +903,7 @@ El "OmniRoute Golden Set" precargado contiene 10 casos de prueba que cubren:
 ## 🛠️ Stack Tecnológico
 
 - **Runtime**: Node.js 20+
-- **Lenguaje**: TypeScript 5.9 — **100% TypeScript** en `src/` y `open-sse/` (v1.0.0)
+- **Lenguaje**: TypeScript 5.9 — **100% TypeScript** en `src/` y `open-sse/` (v1.0.6)
 - **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
 - **Base de Datos**: LowDB (JSON) + SQLite (estado del dominio + logs de proxy)
 - **Streaming**: Server-Sent Events (SSE)
@@ -932,9 +933,12 @@ El "OmniRoute Golden Set" precargado contiene 10 casos de prueba que cubren:
 
 ## 📧 Soporte
 
+> 💬 **¡Únete a la comunidad!** [Grupo WhatsApp](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) — Obtén ayuda, comparte consejos y mantente al día.
+
 - **Website**: [omniroute.online](https://omniroute.online)
 - **GitHub**: [github.com/diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
 - **Issues**: [github.com/diegosouzapw/OmniRoute/issues](https://github.com/diegosouzapw/OmniRoute/issues)
+- **WhatsApp**: [Grupo de la Comunidad](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 - **Proyecto Original**: [9router por decolua](https://github.com/decolua/9router)
 
 ---
@@ -957,7 +961,7 @@ Consulta [CONTRIBUTING.md](CONTRIBUTING.md) para directrices detalladas.
 
 ```bash
 # Crea un release — la publicación en npm ocurre automáticamente
-gh release create v1.0.0 --title "v1.0.0" --generate-notes
+gh release create v1.0.6 --title "v1.0.6" --generate-notes
 ```
 
 ---

README.fr.md

@@ -100,6 +100,7 @@ _Connectez n'importe quel IDE ou outil CLI alimenté par l'IA via OmniRoute —
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
 [![License](https://img.shields.io/github/license/diegosouzapw/OmniRoute)](https://github.com/diegosouzapw/OmniRoute/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
+[![WhatsApp](https://img.shields.io/badge/WhatsApp-Community-25D366?logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 
 [🌐 Site web](https://omniroute.online) • [🚀 Démarrage rapide](#-démarrage-rapide) • [💡 Fonctionnalités](#-fonctionnalités-principales) • [📖 Docs](#-documentation) • [💰 Tarifs](#-aperçu-des-tarifs)
 
@@ -242,7 +243,7 @@ docker compose --profile cli up -d
 | Image                    | Tag      | Taille | Description             |
 | ------------------------ | -------- | ------ | ----------------------- |
 | `diegosouzapw/omniroute` | `latest` | ~250MB | Dernière version stable |
-| `diegosouzapw/omniroute` | `1.0.0`  | ~250MB | Version actuelle        |
+| `diegosouzapw/omniroute` | `1.0.6`  | ~250MB | Version actuelle        |
 
 ---
 
@@ -892,7 +893,7 @@ Le « OmniRoute Golden Set » préchargé contient 10 cas de test :
 **Le test de connexion affiche « Invalid » pour les fournisseurs compatibles OpenAI**
 
 - Beaucoup de fournisseurs n'exposent pas le point de terminaison `/models`
-- OmniRoute v1.0.0+ inclut une validation de secours via chat completions
+- OmniRoute v1.0.6+ inclut une validation de secours via chat completions
 - Assurez-vous que l'URL de base inclut le suffixe `/v1`
 
 </details>
@@ -902,7 +903,7 @@ Le « OmniRoute Golden Set » préchargé contient 10 cas de test :
 ## 🛠️ Stack technologique
 
 - **Runtime** : Node.js 20+
-- **Langage** : TypeScript 5.9 — **100% TypeScript** dans `src/` et `open-sse/` (v1.0.0)
+- **Langage** : TypeScript 5.9 — **100% TypeScript** dans `src/` et `open-sse/` (v1.0.6)
 - **Framework** : Next.js 16 + React 19 + Tailwind CSS 4
 - **Base de données** : LowDB (JSON) + SQLite (état du domaine + logs proxy)
 - **Streaming** : Server-Sent Events (SSE)
@@ -932,9 +933,12 @@ Le « OmniRoute Golden Set » préchargé contient 10 cas de test :
 
 ## 📧 Support
 
+> 💬 **Rejoignez notre communauté !** [Groupe WhatsApp](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) — Obtenez de l'aide, partagez des astuces et restez informé.
+
 - **Site web** : [omniroute.online](https://omniroute.online)
 - **GitHub** : [github.com/diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
 - **Issues** : [github.com/diegosouzapw/OmniRoute/issues](https://github.com/diegosouzapw/OmniRoute/issues)
+- **WhatsApp** : [Groupe communautaire](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 - **Projet original** : [9router par decolua](https://github.com/decolua/9router)
 
 ---
@@ -957,7 +961,7 @@ Consultez [CONTRIBUTING.md](CONTRIBUTING.md) pour les directives détaillées.
 
 ```bash
 # Créer un release — la publication npm est automatique
-gh release create v1.0.0 --title "v1.0.0" --generate-notes
+gh release create v1.0.6 --title "v1.0.6" --generate-notes
 ```
 
 ---

README.it.md

@@ -100,6 +100,7 @@ _Connetti qualsiasi IDE o strumento CLI con IA tramite OmniRoute — gateway API
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
 [![License](https://img.shields.io/github/license/diegosouzapw/OmniRoute)](https://github.com/diegosouzapw/OmniRoute/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
+[![WhatsApp](https://img.shields.io/badge/WhatsApp-Community-25D366?logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 
 [🌐 Sito Web](https://omniroute.online) • [🚀 Avvio Rapido](#-avvio-rapido) • [💡 Funzionalità](#-funzionalità-principali) • [📖 Docs](#-documentazione) • [💰 Prezzi](#-panoramica-prezzi)
 
@@ -242,7 +243,7 @@ docker compose --profile cli up -d
 | Immagine                 | Tag      | Dimensione | Descrizione             |
 | ------------------------ | -------- | ---------- | ----------------------- |
 | `diegosouzapw/omniroute` | `latest` | ~250MB     | Ultima versione stabile |
-| `diegosouzapw/omniroute` | `1.0.0`  | ~250MB     | Versione attuale        |
+| `diegosouzapw/omniroute` | `1.0.6`  | ~250MB     | Versione attuale        |
 
 ---
 
@@ -892,7 +893,7 @@ Il "OmniRoute Golden Set" precaricato contiene 10 casi di test:
 **Il test di connessione mostra "Invalid" per provider compatibili OpenAI**
 
 - Molti provider non espongono l'endpoint `/models`
-- OmniRoute v1.0.0+ include validazione fallback tramite chat completions
+- OmniRoute v1.0.6+ include validazione fallback tramite chat completions
 - Assicurati che la URL base includa il suffisso `/v1`
 
 </details>
@@ -902,7 +903,7 @@ Il "OmniRoute Golden Set" precaricato contiene 10 casi di test:
 ## 🛠️ Stack Tecnologico
 
 - **Runtime**: Node.js 20+
-- **Linguaggio**: TypeScript 5.9 — **100% TypeScript** in `src/` e `open-sse/` (v1.0.0)
+- **Linguaggio**: TypeScript 5.9 — **100% TypeScript** in `src/` e `open-sse/` (v1.0.6)
 - **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
 - **Database**: LowDB (JSON) + SQLite (stato dominio + log proxy)
 - **Streaming**: Server-Sent Events (SSE)
@@ -932,9 +933,13 @@ Il "OmniRoute Golden Set" precaricato contiene 10 casi di test:
 
 ## 📧 Supporto
 
+> 💬 **Unisciti alla nostra community!** [Gruppo WhatsApp](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) — Ottieni aiuto, condividi consigli e rimani aggiornato.
+
 - **Sito Web**: [omniroute.online](https://omniroute.online)
 - **GitHub**: [github.com/diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
 - **Issues**: [github.com/diegosouzapw/OmniRoute/issues](https://github.com/diegosouzapw/OmniRoute/issues)
+- **WhatsApp**: [Gruppo della comunità](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
+- **WhatsApp**: [Gruppo della comunità](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 - **Progetto Originale**: [9router di decolua](https://github.com/decolua/9router)
 
 ---
@@ -957,7 +962,7 @@ Consulta [CONTRIBUTING.md](CONTRIBUTING.md) per le linee guida dettagliate.
 
 ```bash
 # Crea un rilascio — la pubblicazione npm avviene automaticamente
-gh release create v1.0.0 --title "v1.0.0" --generate-notes
+gh release create v1.0.6 --title "v1.0.6" --generate-notes
 ```
 
 ---

README.md

@@ -100,8 +100,9 @@ _Connect any AI-powered IDE or CLI tool through OmniRoute — free API gateway f
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
 [![License](https://img.shields.io/github/license/diegosouzapw/OmniRoute)](https://github.com/diegosouzapw/OmniRoute/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
+[![WhatsApp](https://img.shields.io/badge/WhatsApp-Community-25D366?logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 
-[🌐 Website](https://omniroute.online) • [🚀 Quick Start](#-quick-start) • [💡 Features](#-key-features) • [📖 Docs](#-documentation) • [💰 Pricing](#-pricing-at-a-glance)
+[🌐 Website](https://omniroute.online) • [🚀 Quick Start](#-quick-start) • [💡 Features](#-key-features) • [📖 Docs](#-documentation) • [💰 Pricing](#-pricing-at-a-glance) • [💬 WhatsApp](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 
 🌐 **Available in:** [English](README.md) | [Português](README.pt-BR.md) | [Español](README.es.md) | [Русский](README.ru.md) | [中文](README.zh-CN.md) | [Deutsch](README.de.md) | [Français](README.fr.md) | [Italiano](README.it.md)
 
@@ -242,7 +243,7 @@ docker compose --profile cli up -d
 | Image                    | Tag      | Size   | Description           |
 | ------------------------ | -------- | ------ | --------------------- |
 | `diegosouzapw/omniroute` | `latest` | ~250MB | Latest stable release |
-| `diegosouzapw/omniroute` | `1.0.0`  | ~250MB | Current version       |
+| `diegosouzapw/omniroute` | `1.0.3`  | ~250MB | Current version       |
 
 ---
 
@@ -340,7 +341,7 @@ Access via: WhatsApp, Telegram, Slack, Discord, iMessage, Signal...
 | ------------------------------- | ------------------------------------------------------------------------------ |
 | 🎯 **Smart 4-Tier Fallback**    | Auto-route: Subscription → API Key → Cheap → Free                              |
 | 📊 **Real-Time Quota Tracking** | Live token count + reset countdown per provider                                |
-| 🔄 **Format Translation**       | OpenAI ↔ Claude ↔ Gemini ↔ Cursor ↔ Kiro seamless                              |
+| 🔄 **Format Translation**       | OpenAI ↔ Claude ↔ Gemini ↔ Cursor ↔ Kiro seamless + response sanitization      |
 | 👥 **Multi-Account Support**    | Multiple accounts per provider with intelligent selection                      |
 | 🔄 **Auto Token Refresh**       | OAuth tokens refresh automatically with retry                                  |
 | 🎨 **Custom Combos**            | 6 strategies: fill-first, round-robin, p2c, random, least-used, cost-optimized |
@@ -372,20 +373,23 @@ Access via: WhatsApp, Telegram, Slack, Discord, iMessage, Signal...
 | 🔒 **TLS Fingerprint Spoofing** | Bypass TLS-based bot detection via wreq-js                    |
 | 🌐 **IP Filtering**             | Allowlist/blocklist for API access control                    |
 | 📊 **Editable Rate Limits**     | Configurable RPM, min gap, and max concurrent at system level |
+| 🛡 **API Endpoint Protection**  | Auth gating + provider blocking for the `/models` endpoint    |
 
 ### 📊 Observability & Analytics
 
-| Feature                      | What It Does                                                    |
-| ---------------------------- | --------------------------------------------------------------- |
-| 📝 **Request Logging**       | Debug mode with full request/response logs                      |
-| 💾 **SQLite Proxy Logs**     | Persistent proxy logs survive server restarts                   |
-| 📊 **Analytics Dashboard**   | Recharts-powered: stat cards, model usage chart, provider table |
-| 📈 **Progress Tracking**     | Opt-in SSE progress events for streaming                        |
-| 🧪 **LLM Evaluations**       | Golden set testing with 4 match strategies                      |
-| 🔍 **Request Telemetry**     | p50/p95/p99 latency aggregation + X-Request-Id tracing          |
-| 📋 **Request Logs + Quotas** | Dedicated pages for log browsing and limits/quotas tracking     |
-| 🏥 **Health Dashboard**      | System uptime, circuit breaker states, lockouts, cache stats    |
-| 💰 **Cost Tracking**         | Budget management + per-model pricing configuration             |
+| Feature                    | What It Does                                                           |
+| -------------------------- | ---------------------------------------------------------------------- |
+| 📝 **Request Logging**     | Debug mode with full request/response logs                             |
+| 💾 **SQLite Proxy Logs**   | Persistent proxy logs survive server restarts                          |
+| 📊 **Analytics Dashboard** | Recharts-powered: stat cards, model usage chart, provider table        |
+| 📈 **Progress Tracking**   | Opt-in SSE progress events for streaming                               |
+| 🧪 **LLM Evaluations**     | Golden set testing with 4 match strategies                             |
+| 🔍 **Request Telemetry**   | p50/p95/p99 latency aggregation + X-Request-Id tracing                 |
+| 📋 **Logs Dashboard**      | Unified 4-tab page: Request Logs, Proxy Logs, Audit Logs, Console      |
+| 🖥️ **Console Log Viewer**  | Real-time terminal-style viewer with level filter, search, auto-scroll |
+| 📑 **File-Based Logging**  | Console interceptor captures all output to JSON log file with rotation |
+| 🏥 **Health Dashboard**    | System uptime, circuit breaker states, lockouts, cache stats           |
+| 💰 **Cost Tracking**       | Budget management + per-model pricing configuration                    |
 
 ### ☁️ Deployment & Sync
 
@@ -429,6 +433,10 @@ Seamless translation between formats:
 - **OpenAI** ↔ **Claude** ↔ **Gemini** ↔ **OpenAI Responses**
 - Your CLI tool sends OpenAI format → OmniRoute translates → Provider receives native format
 - Works with any tool that supports custom OpenAI endpoints
+- **Response sanitization** — Strips non-standard fields for strict OpenAI SDK compatibility
+- **Role normalization** — `developer` → `system` for non-OpenAI; `system` → `user` for GLM/ERNIE models
+- **Think tag extraction** — `<think>` blocks → `reasoning_content` for thinking models
+- **Structured output** — `json_schema` → Gemini's `responseMimeType`/`responseSchema`
 
 ### 👥 Multi-Account Support
 
@@ -851,6 +859,99 @@ The pre-loaded "OmniRoute Golden Set" contains 10 test cases covering:
 
 ---
 
+## 🔐 OAuth em Servidor Remoto (Remote OAuth Setup)
+
+<a name="oauth-em-servidor-remoto"></a>
+
+> **⚠️ IMPORTANTE para usuários com OmniRoute em VPS/Docker/servidor remoto**
+
+### Por que o OAuth do Antigravity / Gemini CLI falha em servidores remotos?
+
+Os provedores **Antigravity** e **Gemini CLI** usam **Google OAuth 2.0** para autenticação. O Google exige que a `redirect_uri` usada no fluxo OAuth seja **exatamente** uma das URIs pré-cadastradas no Google Cloud Console do aplicativo.
+
+As credenciais OAuth embutidas no OmniRoute estão cadastradas **apenas para `localhost`**. Quando você acessa o OmniRoute em um servidor remoto (ex: `https://omniroute.meuservidor.com`), o Google rejeita a autenticação com:
+
+```
+Error 400: redirect_uri_mismatch
+```
+
+### Solução: Configure suas próprias credenciais OAuth
+
+Você precisa criar um **OAuth 2.0 Client ID** no Google Cloud Console com a URI do seu servidor.
+
+#### Passo a passo
+
+**1. Acesse o Google Cloud Console**
+
+Abra: [https://console.cloud.google.com/apis/credentials](https://console.cloud.google.com/apis/credentials)
+
+**2. Crie um novo OAuth 2.0 Client ID**
+
+- Clique em **"+ Create Credentials"** → **"OAuth client ID"**
+- Tipo de aplicativo: **"Web application"**
+- Nome: escolha qualquer nome (ex: `OmniRoute Remote`)
+
+**3. Adicione as Authorized Redirect URIs**
+
+No campo **"Authorized redirect URIs"**, adicione:
+
+```
+https://seu-servidor.com/callback
+```
+
+> Substitua `seu-servidor.com` pelo domínio ou IP do seu servidor (inclua a porta se necessário, ex: `http://45.33.32.156:20128/callback`).
+
+**4. Salve e copie as credenciais**
+
+Após criar, o Google mostrará o **Client ID** e o **Client Secret**.
+
+**5. Configure as variáveis de ambiente**
+
+No seu `.env` (ou nas variáveis de ambiente do Docker):
+
+```bash
+# Para Antigravity:
+ANTIGRAVITY_OAUTH_CLIENT_ID=seu-client-id.apps.googleusercontent.com
+ANTIGRAVITY_OAUTH_CLIENT_SECRET=GOCSPX-seu-secret
+
+# Para Gemini CLI:
+GEMINI_OAUTH_CLIENT_ID=seu-client-id.apps.googleusercontent.com
+GEMINI_OAUTH_CLIENT_SECRET=GOCSPX-seu-secret
+GEMINI_CLI_OAUTH_CLIENT_SECRET=GOCSPX-seu-secret
+```
+
+**6. Reinicie o OmniRoute**
+
+```bash
+# Se usando npm:
+npm run dev
+
+# Se usando Docker:
+docker restart omniroute
+```
+
+**7. Tente conectar novamente**
+
+Dashboard → Providers → Antigravity (ou Gemini CLI) → OAuth
+
+Agora o Google redirecionará corretamente para `https://seu-servidor.com/callback` e a autenticação funcionará.
+
+---
+
+### Workaround temporário (sem configurar credenciais próprias)
+
+Se não quiser criar credenciais próprias agora, ainda é possível usar o fluxo **manual de URL**:
+
+1. O OmniRoute abrirá a URL de autorização do Google
+2. Após você autorizar, o Google tentará redirecionar para `localhost` (que falha no servidor remoto)
+3. **Copie a URL completa** da barra de endereço do seu browser (mesmo que a página não carregue)
+4. Cole essa URL no campo que aparece no modal de conexão do OmniRoute
+5. Clique em **"Connect"**
+
+> Este workaround funciona porque o código de autorização na URL é válido independente do redirect ter carregado ou não.
+
+---
+
 ## 🐛 Troubleshooting
 
 <details>
@@ -899,7 +1000,7 @@ The pre-loaded "OmniRoute Golden Set" contains 10 test cases covering:
 **Connection test shows "Invalid" for OpenAI-compatible providers**
 
 - Many providers don't expose a `/models` endpoint
-- OmniRoute v1.0.0+ includes fallback validation via chat completions
+- OmniRoute v1.0.6+ includes fallback validation via chat completions
 - Ensure base URL includes `/v1` suffix
 
 </details>
@@ -908,8 +1009,8 @@ The pre-loaded "OmniRoute Golden Set" contains 10 test cases covering:
 
 ## 🛠️ Tech Stack
 
-- **Runtime**: Node.js 20+
-- **Language**: TypeScript 5.9 — **100% TypeScript** across `src/` and `open-sse/` (v1.0.0)
+- **Runtime**: Node.js 18–22 LTS (⚠️ Node.js 24+ is **not supported** — `better-sqlite3` native binaries are incompatible)
+- **Language**: TypeScript 5.9 — **100% TypeScript** across `src/` and `open-sse/` (v1.0.6)
 - **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
 - **Database**: LowDB (JSON) + SQLite (domain state + proxy logs)
 - **Streaming**: Server-Sent Events (SSE)
@@ -985,9 +1086,12 @@ OmniRoute has **210+ features planned** across multiple development phases. Here
 
 ## 📧 Support
 
+> 💬 **Join our community!** [WhatsApp Group](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) — Get help, share tips, and stay updated.
+
 - **Website**: [omniroute.online](https://omniroute.online)
 - **GitHub**: [github.com/diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
 - **Issues**: [github.com/diegosouzapw/OmniRoute/issues](https://github.com/diegosouzapw/OmniRoute/issues)
+- **WhatsApp**: [Community Group](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 - **Original Project**: [9router by decolua](https://github.com/decolua/9router)
 
 ---
@@ -1010,7 +1114,7 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines.
 
 ```bash
 # Create a release — npm publish happens automatically
-gh release create v1.0.0 --title "v1.0.0" --generate-notes
+gh release create v1.0.6 --title "v1.0.6" --generate-notes
 ```
 
 ---

README.pt-BR.md

@@ -100,6 +100,7 @@ _Conecte qualquer IDE ou ferramenta CLI com IA através do OmniRoute — gateway
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
 [![License](https://img.shields.io/github/license/diegosouzapw/OmniRoute)](https://github.com/diegosouzapw/OmniRoute/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
+[![WhatsApp](https://img.shields.io/badge/WhatsApp-Community-25D366?logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 
 [🌐 Website](https://omniroute.online) • [🚀 Início Rápido](#-início-rápido) • [💡 Funcionalidades](#-funcionalidades-principais) • [📖 Docs](#-documentação) • [💰 Preços](#-preços-resumidos)
 
@@ -242,7 +243,7 @@ docker compose --profile cli up -d
 | Imagem                   | Tag      | Tamanho | Descrição             |
 | ------------------------ | -------- | ------- | --------------------- |
 | `diegosouzapw/omniroute` | `latest` | ~250MB  | Última versão estável |
-| `diegosouzapw/omniroute` | `1.0.0`  | ~250MB  | Versão atual          |
+| `diegosouzapw/omniroute` | `1.0.6`  | ~250MB  | Versão atual          |
 
 ---
 
@@ -372,6 +373,7 @@ Acesso via: WhatsApp, Telegram, Slack, Discord, iMessage, Signal...
 | 🔒 **Spoofing de Fingerprint TLS** | Bypass de detecção de bot via TLS com wreq-js                         |
 | 🌐 **Filtragem de IP**             | Allowlist/blocklist para controle de acesso à API                     |
 | 📊 **Rate Limits Editáveis**       | RPM, gap mínimo e concorrência máxima configuráveis                   |
+| 🛡 **Proteção de Endpoint API**    | Gateway de Auth + bloqueio de provedores para o endpoint `/models`    |
 
 ### 📊 Observabilidade e Analytics
 
@@ -899,7 +901,7 @@ O "OmniRoute Golden Set" pré-carregado contém 10 casos de teste cobrindo:
 **Teste de conexão mostra "Invalid" para provedores compatíveis com OpenAI**
 
 - Muitos provedores não expõem endpoint `/models`
-- OmniRoute v1.0.0+ inclui validação via chat completions como fallback
+- OmniRoute v1.0.6+ inclui validação via chat completions como fallback
 - Certifique-se de que a base URL inclui sufixo `/v1`
 
 </details>
@@ -909,7 +911,7 @@ O "OmniRoute Golden Set" pré-carregado contém 10 casos de teste cobrindo:
 ## 🛠️ Stack Tecnológico
 
 - **Runtime**: Node.js 20+
-- **Linguagem**: TypeScript 5.9 — **100% TypeScript** em `src/` e `open-sse/` (v1.0.0)
+- **Linguagem**: TypeScript 5.9 — **100% TypeScript** em `src/` e `open-sse/` (v1.0.6)
 - **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
 - **Banco de Dados**: LowDB (JSON) + SQLite (estado do domínio + logs de proxy)
 - **Streaming**: Server-Sent Events (SSE)
@@ -985,9 +987,12 @@ O OmniRoute tem **210+ funcionalidades planejadas** em múltiplas fases de desen
 
 ## 📧 Suporte
 
+> 💬 **Participe da comunidade!** [Grupo WhatsApp](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) — Tire dúvidas, compartilhe dicas e fique atualizado.
+
 - **Website**: [omniroute.online](https://omniroute.online)
 - **GitHub**: [github.com/diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
 - **Issues**: [github.com/diegosouzapw/OmniRoute/issues](https://github.com/diegosouzapw/OmniRoute/issues)
+- **WhatsApp**: [Grupo da Comunidade](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 - **Projeto Original**: [9router por decolua](https://github.com/decolua/9router)
 
 ---
@@ -1010,7 +1015,7 @@ Veja [CONTRIBUTING.md](CONTRIBUTING.md) para diretrizes detalhadas.
 
 ```bash
 # Crie um release — publicação no npm acontece automaticamente
-gh release create v1.0.0 --title "v1.0.0" --generate-notes
+gh release create v1.0.6 --title "v1.0.6" --generate-notes
 ```
 
 ---

README.ru.md

@@ -100,6 +100,7 @@ _Подключайте любую IDE или CLI-инструмент с AI ч
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
 [![License](https://img.shields.io/github/license/diegosouzapw/OmniRoute)](https://github.com/diegosouzapw/OmniRoute/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
+[![WhatsApp](https://img.shields.io/badge/WhatsApp-Community-25D366?logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 
 [🌐 Сайт](https://omniroute.online) • [🚀 Быстрый старт](#-быстрый-старт) • [💡 Функции](#-основные-функции) • [📖 Документация](#-документация) • [💰 Цены](#-обзор-цен)
 
@@ -242,7 +243,7 @@ docker compose --profile cli up -d
 | Образ                    | Тег      | Размер | Описание                   |
 | ------------------------ | -------- | ------ | -------------------------- |
 | `diegosouzapw/omniroute` | `latest` | ~250MB | Последний стабильный релиз |
-| `diegosouzapw/omniroute` | `1.0.0`  | ~250MB | Текущая версия             |
+| `diegosouzapw/omniroute` | `1.0.6`  | ~250MB | Текущая версия             |
 
 ---
 
@@ -892,7 +893,7 @@ OmniRoute включает встроенный фреймворк оценки
 **Тест подключения показывает «Invalid» для OpenAI-совместимых провайдеров**
 
 - Многие провайдеры не предоставляют endpoint `/models`
-- OmniRoute v1.0.0+ включает fallback-валидацию через chat completions
+- OmniRoute v1.0.6+ включает fallback-валидацию через chat completions
 - Убедитесь что base URL содержит суффикс `/v1`
 
 </details>
@@ -902,7 +903,7 @@ OmniRoute включает встроенный фреймворк оценки
 ## 🛠️ Технологический стек
 
 - **Runtime**: Node.js 20+
-- **Язык**: TypeScript 5.9 — **100% TypeScript** в `src/` и `open-sse/` (v1.0.0)
+- **Язык**: TypeScript 5.9 — **100% TypeScript** в `src/` и `open-sse/` (v1.0.6)
 - **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
 - **База данных**: LowDB (JSON) + SQLite (состояние домена + proxy-логи)
 - **Стриминг**: Server-Sent Events (SSE)
@@ -932,9 +933,12 @@ OmniRoute включает встроенный фреймворк оценки
 
 ## 📧 Поддержка
 
+> 💬 **Присоединяйтесь к сообществу!** [Группа WhatsApp](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) — Получайте помощь, делитесь советами и оставайтесь в курсе.
+
 - **Сайт**: [omniroute.online](https://omniroute.online)
 - **GitHub**: [github.com/diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
 - **Issues**: [github.com/diegosouzapw/OmniRoute/issues](https://github.com/diegosouzapw/OmniRoute/issues)
+- **WhatsApp**: [Группа сообщества](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 - **Оригинальный проект**: [9router от decolua](https://github.com/decolua/9router)
 
 ---
@@ -957,7 +961,7 @@ OmniRoute включает встроенный фреймворк оценки
 
 ```bash
 # Создайте релиз — публикация в npm происходит автоматически
-gh release create v1.0.0 --title "v1.0.0" --generate-notes
+gh release create v1.0.6 --title "v1.0.6" --generate-notes
 ```
 
 ---

README.zh-CN.md

@@ -100,6 +100,7 @@ _通过 OmniRoute 连接任何 AI 驱动的 IDE 或 CLI 工具 — 免费 API
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
 [![License](https://img.shields.io/github/license/diegosouzapw/OmniRoute)](https://github.com/diegosouzapw/OmniRoute/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
+[![WhatsApp](https://img.shields.io/badge/WhatsApp-Community-25D366?logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 
 [🌐 网站](https://omniroute.online) • [🚀 快速开始](#-快速开始) • [💡 功能特性](#-核心功能) • [📖 文档](#-文档) • [💰 定价](#-定价概览)
 
@@ -242,7 +243,7 @@ docker compose --profile cli up -d
 | 镜像                     | 标签     | 大小   | 描述       |
 | ------------------------ | -------- | ------ | ---------- |
 | `diegosouzapw/omniroute` | `latest` | ~250MB | 最新稳定版 |
-| `diegosouzapw/omniroute` | `1.0.0`  | ~250MB | 当前版本   |
+| `diegosouzapw/omniroute` | `1.0.6`  | ~250MB | 当前版本   |
 
 ---
 
@@ -892,7 +893,7 @@ OmniRoute 包含内置评估框架，用于针对黄金集测试 LLM 响应质
 **兼容 OpenAI 的提供商连接测试显示 "Invalid"**
 
 - 许多提供商不暴露 `/models` 端点
-- OmniRoute v1.0.0+ 包含通过 chat completions 的回退验证
+- OmniRoute v1.0.6+ 包含通过 chat completions 的回退验证
 - 确保 base URL 包含 `/v1` 后缀
 
 </details>
@@ -902,7 +903,7 @@ OmniRoute 包含内置评估框架，用于针对黄金集测试 LLM 响应质
 ## 🛠️ 技术栈
 
 - **运行时**: Node.js 20+
-- **语言**: TypeScript 5.9 — `src/` 和 `open-sse/` 中 **100% TypeScript**（v1.0.0）
+- **语言**: TypeScript 5.9 — `src/` 和 `open-sse/` 中 **100% TypeScript**（v1.0.6）
 - **框架**: Next.js 16 + React 19 + Tailwind CSS 4
 - **数据库**: LowDB (JSON) + SQLite（领域状态 + 代理日志）
 - **流式传输**: Server-Sent Events (SSE)
@@ -932,9 +933,12 @@ OmniRoute 包含内置评估框架，用于针对黄金集测试 LLM 响应质
 
 ## 📧 支持
 
+> 💬 **加入我们的社区！** [WhatsApp 群组](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) — 获取帮助、分享技巧、了解最新动态。
+
 - **网站**: [omniroute.online](https://omniroute.online)
 - **GitHub**: [github.com/diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
 - **Issues**: [github.com/diegosouzapw/OmniRoute/issues](https://github.com/diegosouzapw/OmniRoute/issues)
+- **WhatsApp**: [社区群组](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 - **原始项目**: [decolua 的 9router](https://github.com/decolua/9router)
 
 ---
@@ -957,7 +961,7 @@ OmniRoute 包含内置评估框架，用于针对黄金集测试 LLM 响应质
 
 ```bash
 # 创建发布 — npm 发布自动完成
-gh release create v1.0.0 --title "v1.0.0" --generate-notes
+gh release create v1.0.6 --title "v1.0.6" --generate-notes
 ```
 
 ---

SECURITY.md

@@ -20,9 +20,9 @@ If you discover a security vulnerability in OmniRoute, please report it responsi
 
 | Version | Support Status |
 | ------- | -------------- |
-| 0.8.x   | ✅ Active      |
-| 0.7.x   | ✅ Security    |
-| < 0.7.0 | ❌ Unsupported |
+| 1.0.x   | ✅ Active      |
+| 0.8.x   | ✅ Security    |
+| < 0.8.0 | ❌ Unsupported |
 
 ---
 

bin/omniroute.mjs

@@ -81,17 +81,26 @@ console.log(`
   \\____/|_| |_| |_|_| |_|_|_|  \\_\\___/ \\__,_|\\__\\___|
 \x1b[0m`);
 
+// ── Node.js version check ──────────────────────────────────
+const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
+if (nodeMajor >= 24) {
+  console.warn(`\x1b[33m  ⚠  Warning: You are running Node.js ${process.versions.node}.
+     OmniRoute uses better-sqlite3, a native addon that does not yet
+     have compatible prebuilt binaries for Node.js 24+.
+     You may experience errors like "is not a valid Win32 application"
+     or "NODE_MODULE_VERSION mismatch".
+
+     Recommended: use Node.js 22 LTS (or 20 LTS).
+     Workaround:  npm rebuild better-sqlite3\x1b[0m
+`);
+}
+
 // ── Resolve server entry ───────────────────────────────────
 const serverJs = join(APP_DIR, "server.js");
 
 if (!existsSync(serverJs)) {
-  console.error(
-    "\x1b[31m✖ Server not found at:\x1b[0m",
-    serverJs,
-  );
-  console.error(
-    "  This usually means the package was not built correctly.",
-  );
+  console.error("\x1b[31m✖ Server not found at:\x1b[0m", serverJs);
+  console.error("  This usually means the package was not built correctly.");
   console.error("  Try reinstalling: npm install -g omniroute");
   process.exit(1);
 }
@@ -119,7 +128,10 @@ server.stdout.on("data", (data) => {
   process.stdout.write(text);
 
   // Detect server ready
-  if (!started && (text.includes("Ready") || text.includes("started") || text.includes("listening"))) {
+  if (
+    !started &&
+    (text.includes("Ready") || text.includes("started") || text.includes("listening"))
+  ) {
     started = true;
     onReady();
   }

docker-compose.yml

@@ -18,6 +18,8 @@
 x-common: &common
   restart: unless-stopped
   env_file: .env
+  environment:
+    - DATA_DIR=/app/data # Must match the volume mount below
   volumes:
     - omniroute-data:/app/data
   healthcheck:

docs/ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # OmniRoute Architecture
 
-_Last updated: 2026-02-17_
+_Last updated: 2026-02-18_
 
 ## Executive Summary
 
@@ -17,6 +17,9 @@ Core capabilities:
 - Embedding generation via `/v1/embeddings` (6 providers, 9 models)
 - Image generation via `/v1/images/generations` (4 providers, 9 models)
 - Think tag parsing (`<think>...</think>`) for reasoning models
+- Response sanitization for strict OpenAI SDK compatibility
+- Role normalization (developer→system, system→user) for cross-provider compatibility
+- Structured output conversion (json_schema → Gemini responseSchema)
 - Local persistence for providers, keys, aliases, combos, settings, pricing
 - Usage/cost tracking and request logging
 - Optional cloud sync for multi-device/state sync
@@ -180,6 +183,8 @@ Main flow modules:
 - Embedding provider registry: `open-sse/config/embeddingRegistry.ts`
 - Image generation handler: `open-sse/handlers/imageGeneration.ts`
 - Image provider registry: `open-sse/config/imageRegistry.ts`
+- Response sanitization: `open-sse/handlers/responseSanitizer.ts`
+- Role normalization: `open-sse/services/roleNormalizer.ts`
 
 Services (business logic):
 
@@ -647,6 +652,13 @@ Source Format → OpenAI (hub) → Target Format
 
 Translations are selected dynamically based on source payload shape and provider target format.
 
+Additional processing layers in the translation pipeline:
+
+- **Response sanitization** — Strips non-standard fields from OpenAI-format responses (both streaming and non-streaming) to ensure strict SDK compliance
+- **Role normalization** — Converts `developer` → `system` for non-OpenAI targets; merges `system` → `user` for models that reject the system role (GLM, ERNIE)
+- **Think tag extraction** — Parses `<think>...</think>` blocks from content into `reasoning_content` field
+- **Structured output** — Converts OpenAI `response_format.json_schema` to Gemini's `responseMimeType` + `responseSchema`
+
 ## Supported API Endpoints
 
 | Endpoint                                           | Format             | Handler                                              |
@@ -759,8 +771,8 @@ Environment variables actively used by code:
 
 ## Operational Verification Checklist
 
-- Build from source: `cd /root/dev/omniroute && npm run build`
-- Build Docker image: `cd /root/dev/omniroute && docker build -t omniroute .`
+- Build from source: `npm run build`
+- Build Docker image: `docker build -t omniroute .`
 - Start service and verify:
 - `GET /api/settings`
 - `GET /api/v1/models`

docs/FEATURES.md

@@ -46,7 +46,7 @@ Four modes for debugging API translations: **Playground** (format converter), **
 
 ## ⚙️ Settings
 
-General settings, system storage, backup management (export/import database), appearance (dark/light mode), security, routing, resilience, and advanced configuration.
+General settings, system storage, backup management (export/import database), appearance (dark/light mode), security (includes API endpoint protection and custom provider blocking), routing, resilience, and advanced configuration.
 
 ![Settings Dashboard](screenshots/06-settings.png)
 

docs/TROUBLESHOOTING.md

@@ -177,6 +177,10 @@ Use **Dashboard → Translator** to debug format translation issues:
 - **Thinking tags not appearing** — Check if the target provider supports thinking and the thinking budget setting
 - **Tool calls dropping** — Some format translations may strip unsupported fields; verify in Playground mode
 - **System prompt missing** — Claude and Gemini handle system prompts differently; check translation output
+- **SDK returns raw string instead of object** — Fixed in v1.1.0: response sanitizer now strips non-standard fields (`x_groq`, `usage_breakdown`, etc.) that cause OpenAI SDK Pydantic validation failures
+- **GLM/ERNIE rejects `system` role** — Fixed in v1.1.0: role normalizer automatically merges system messages into user messages for incompatible models
+- **`developer` role not recognized** — Fixed in v1.1.0: automatically converted to `system` for non-OpenAI providers
+- **`json_schema` not working with Gemini** — Fixed in v1.1.0: `response_format` is now converted to Gemini's `responseMimeType` + `responseSchema`
 
 ---
 

docs/USER_GUIDE.md

@@ -610,7 +610,7 @@ The settings page is organized into 5 tabs for easy navigation:
 
 | Tab            | Contents                                                                                       |
 | -------------- | ---------------------------------------------------------------------------------------------- |
-| **Security**   | Login/Password settings and IP Access Control (allowlist/blocklist)                            |
+| **Security**   | Login/Password settings, IP Access Control, API auth for `/models`, and Provider Blocking      |
 | **Routing**    | Global routing strategy (6 options), wildcard model aliases, fallback chains, combo defaults   |
 | **Resilience** | Provider profiles, editable rate limits, circuit breaker status, policies & locked identifiers |
 | **AI**         | Thinking budget configuration, global system prompt injection, prompt cache stats              |

docs/adr/ADR-001-nextjs-foundation.md

@@ -0,0 +1,37 @@
+# ADR-001: Next.js as the Foundation for an AI Gateway
+
+## Status: Accepted
+
+## Context
+
+OmniRoute is an AI routing gateway that translates, forwards, and manages requests across 20+ LLM providers. We needed a framework that could serve both the API proxy layer and a management dashboard from a single codebase.
+
+**Alternatives considered:**
+
+- **Express.js only** — Simpler proxy, but requires separate frontend tooling
+- **Fastify** — Fast, but no built-in SSR/dashboard support
+- **Next.js** — Unified full-stack framework with API routes, SSR, and static pages
+
+## Decision
+
+We chose Next.js because:
+
+1. **Single deployment** — API routes (`/api/*`) and dashboard UI in one process
+2. **Middleware layer** — Native request interception for auth guards and request tracing
+3. **File-based routing** — Easy to map provider endpoints to handlers
+4. **Built-in TypeScript** — Type safety across the entire codebase
+
+## Consequences
+
+**Positive:**
+
+- One `npm run build` produces both API and UI
+- Middleware provides centralized auth and request tracing
+- Dashboard gets automatic code splitting and optimization
+
+**Negative:**
+
+- Next.js middleware has limitations (no heavy imports, edge runtime constraints)
+- Serverless deployment model doesn't align with persistent WebSocket/SSE connections
+- Build times are longer than Express-only setups
+- The SSE proxy layer (`open-sse/`) operates outside Next.js conventions

docs/adr/ADR-002-hub-spoke-translation.md

@@ -0,0 +1,37 @@
+# ADR-002: Hub-and-Spoke Translation with OpenAI as Intermediate Format
+
+## Status: Accepted
+
+## Context
+
+OmniRoute routes requests across 20+ providers, each with its own API format (OpenAI, Anthropic Messages, Google Gemini, AWS Bedrock, etc.). Direct provider-to-provider translation would require O(n²) translators.
+
+**Alternatives considered:**
+
+- **Direct translation** — Each pair needs a dedicated translator (n² complexity)
+- **Common intermediate format** — Translate to/from a canonical format (2n complexity)
+- **Protocol buffers** — Strong typing but heavy overhead for a proxy
+
+## Decision
+
+We use the **OpenAI Chat Completions format** as the canonical intermediate representation. All incoming requests are normalized to OpenAI format, processed, then translated to the target provider's format.
+
+```
+Client → [any format] → OpenAI canonical → [target format] → Provider
+Provider → [response] → OpenAI canonical → [original format] → Client
+```
+
+## Consequences
+
+**Positive:**
+
+- Only 2 translators per provider (inbound + outbound) instead of n² pairs
+- OpenAI format is the de facto standard — most clients already use it
+- Adding a new provider requires only implementing one translator pair
+- Streaming (SSE) works consistently through the canonical format
+
+**Negative:**
+
+- Some provider-specific features may be lost in translation
+- The double translation adds latency (typically < 5ms)
+- OpenAI format changes require updating the canonical representation

docs/adr/ADR-003-dual-storage-sqlite.md

@@ -0,0 +1,39 @@
+# ADR-003: Dual Storage — SQLite Primary with JSON Migration Path
+
+## Status: Accepted
+
+## Context
+
+OmniRoute originally used LowDB (JSON file) for all persistence. As the project grew, JSON-based storage became a bottleneck for concurrent access, querying, and data integrity.
+
+**Alternatives considered:**
+
+- **LowDB only** — Simple but no concurrent access, no ACID, no querying
+- **SQLite only** — Fast, ACID-compliant, but breaks existing deployments
+- **PostgreSQL** — Production-grade but requires external dependency
+- **Dual storage with migration** — SQLite primary + automatic JSON migration
+
+## Decision
+
+We migrated to **SQLite as the primary store** with an automatic one-time migration from `db.json`:
+
+1. On startup, if `db.json` exists and SQLite is empty, auto-migrate all data
+2. All new reads/writes go through SQLite
+3. The `db.json` file is preserved but no longer written to
+
+Settings remain in a hybrid model where LowDB handles simple key-value configuration for backward compatibility.
+
+## Consequences
+
+**Positive:**
+
+- ACID transactions for provider connections, API keys, and usage data
+- Proper SQL queries for analytics and log filtering
+- Concurrent read/write safety via WAL mode
+- Zero-downtime migration from JSON — users upgrade transparently
+
+**Negative:**
+
+- Two storage engines to maintain (SQLite + LowDB for settings)
+- Migration code must handle edge cases and partial data
+- SQLite binary dependency needed in deployment environments

eslint.config.mjs

@@ -1,9 +1,10 @@
 import nextVitals from "eslint-config-next/core-web-vitals";
+import tseslint from "typescript-eslint";
 
 /** @type {import("eslint").Linter.Config[]} */
 const eslintConfig = [
   ...nextVitals,
-  // FASE-02: Security rules
+  // FASE-02: Security rules (strict everywhere)
   {
     rules: {
       "no-eval": "error",
@@ -11,18 +12,28 @@ const eslintConfig = [
       "no-new-func": "error",
     },
   },
-  // Global ignores
+  // Relaxed rules for open-sse and tests (incremental adoption)
+  {
+    files: ["open-sse/**/*.ts", "tests/**/*.mjs", "tests/**/*.ts"],
+    plugins: {
+      "@typescript-eslint": tseslint.plugin,
+    },
+    rules: {
+      "@typescript-eslint/no-explicit-any": "warn",
+      "@next/next/no-assign-module-variable": "off",
+      "react-hooks/rules-of-hooks": "off",
+    },
+  },
+  // Global ignores (open-sse and tests REMOVED — now linted)
   {
     ignores: [
       ".next/**",
       "out/**",
       "build/**",
       "next-env.d.ts",
-      "tests/**",
       "scripts/**",
       "bin/**",
       "node_modules/**",
-      "open-sse/**",
     ],
   },
 ];

llm.txt

@@ -0,0 +1,134 @@
+# OmniRoute
+
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 36+ AI providers — all through a single OpenAI-compatible endpoint.
+
+## Overview
+
+OmniRoute solves the problem of managing multiple AI provider subscriptions, quotas, and rate limits. It sits between your AI-powered tools (IDE agents, CLI tools) and AI providers, routing requests intelligently through a 4-tier fallback system: Subscription → API Key → Cheap → Free.
+
+**Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
+
+## Tech Stack
+
+- **Runtime:** Node.js >= 18
+- **Framework:** Next.js 16 (App Router) with TypeScript
+- **Database:** SQLite via better-sqlite3 (local, zero-config)
+- **State management:** Zustand (client), lowdb (server JSON persistence)
+- **UI:** React 19, Tailwind CSS 4, Recharts for analytics
+- **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
+- **Background jobs:** Custom token health check scheduler
+- **Streaming:** Server-Sent Events (SSE) for real-time proxy responses
+- **Proxy engine:** Custom pipeline with format translation, circuit breaker, rate limiting
+- **Package:** Published on npm (`omniroute`) and Docker Hub (`diegosouzapw/omniroute`)
+
+## Project Structure
+
+```
+/
+├── src/                          # Main application source
+│   ├── app/                      # Next.js App Router pages and API routes
+│   │   ├── (dashboard)/          # Dashboard UI pages (providers, combos, analytics, logs, etc.)
+│   │   ├── api/                  # REST API endpoints
+│   │   │   ├── v1/               # OpenAI-compatible API (chat, models, embeddings, images, audio)
+│   │   │   ├── oauth/            # OAuth flows per provider (authorize, exchange, callback)
+│   │   │   ├── providers/        # Provider CRUD and batch testing
+│   │   │   ├── models/           # Dashboard model listing and aliases
+│   │   │   ├── combos/           # Combo CRUD (multi-model fallback chains)
+│   │   │   └── ...               # Other endpoints (usage, logs, health, settings, etc.)
+│   │   └── login/                # Login page
+│   ├── domain/                   # Domain types and business logic interfaces
+│   ├── lib/                      # Core libraries
+│   │   ├── db/                   # SQLite database layer (providers, combos, prompts, logs)
+│   │   ├── oauth/                # OAuth providers, services, and utilities
+│   │   │   ├── providers/        # Provider-specific OAuth configs (GitHub, Google, Claude, etc.)
+│   │   │   ├── services/         # Provider-specific token exchange logic
+│   │   │   └── utils/            # PKCE, callback server, token helpers
+│   │   ├── cloudSync.ts          # Cloud sync via Cloudflare Workers
+│   │   ├── tokenHealthCheck.ts   # Background OAuth token refresh scheduler
+│   │   └── localDb.ts            # Unified database access layer
+│   ├── shared/                   # Shared utilities, components, and constants
+│   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, etc.)
+│   │   ├── constants/            # Provider definitions, model lists, pricing
+│   │   └── utils/                # Helpers (auth, CORS, error codes, machine ID)
+│   ├── sse/                      # SSE proxy pipeline
+│   │   ├── services/             # Auth resolution, format translation, response handling
+│   │   └── middleware/           # Rate limiting, circuit breaker, caching, idempotency
+│   ├── store/                    # Zustand client-side stores
+│   ├── types/                    # TypeScript type definitions
+│   ├── proxy.ts                  # Main proxy request handler
+│   └── server-init.ts            # Server initialization (DB, health checks)
+├── open-sse/                     # Standalone SSE server (npm workspace)
+│   ├── config/                   # Model registries (embedding, image, audio, rerank, moderation)
+│   ├── handlers/                 # Request handlers per API type
+│   └── translators/              # Format translators (OpenAI ↔ Claude ↔ Gemini ↔ Responses)
+├── tests/                        # Test suites
+│   ├── unit/                     # Unit tests (32+ test files)
+│   └── integration/              # Integration tests
+├── docs/                         # Documentation and screenshots
+├── bin/                          # CLI entry points (omniroute, reset-password)
+└── .env.example                  # Environment variable template
+```
+
+## Key Architectural Decisions
+
+1. **OpenAI-compatible API surface:** All incoming requests follow the OpenAI API format (`/v1/chat/completions`, `/v1/models`, etc.). This makes OmniRoute a drop-in replacement for any tool that supports custom OpenAI endpoints.
+
+2. **Provider abstraction via format translators:** Each AI provider (Claude, Gemini, etc.) has a translator in `open-sse/translators/` that converts between the OpenAI format and the provider's native format. This happens transparently.
+
+3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider are supported for multi-account rotation.
+
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 6 strategies: fill-first, round-robin, power-of-two-choices, random, least-used, cost-optimized.
+
+5. **SSE proxy pipeline (`src/sse/`):** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
+
+6. **SQLite for persistence:** All state (providers, combos, logs, settings) is stored in a single SQLite database file at `data/omniroute.db`. This keeps the app self-contained and zero-config.
+
+7. **OAuth with PKCE:** OAuth flows use PKCE for security. A local callback server (`src/lib/oauth/utils/server.ts`) handles the redirect. Token refresh is handled by a background job (`tokenHealthCheck.ts`).
+
+## Main Flows
+
+### Proxy Request Flow
+1. Client sends OpenAI-format request to `/v1/chat/completions`
+2. API key validation (`src/shared/utils/apiAuth.ts`)
+3. Model resolution: direct model or combo lookup
+4. For combos: iterate through models in fallback order
+5. Auth resolution: get credentials for the target provider
+6. Format translation: OpenAI → provider native format
+7. Upstream request with circuit breaker and rate limiting
+8. Response translation: provider → OpenAI format
+9. SSE streaming back to client
+
+### OAuth Flow
+1. Dashboard initiates `/api/oauth/[provider]/authorize`
+2. User completes OAuth login in browser
+3. Callback hits `/api/oauth/[provider]/exchange`
+4. Tokens stored as a provider connection in SQLite
+5. Background job refreshes tokens before expiry
+
+### Model Listing
+- `/api/models` — Dashboard endpoint, lists all defined models with aliases
+- `/v1/models` — OpenAI-compatible endpoint, lists only models from active providers
+
+## Important Notes for LLMs
+
+1. **Two model endpoints exist:** `/api/models` (dashboard, all models) and `/v1/models` (OpenAI-compatible, active only). Don't confuse them.
+
+2. **Provider IDs vs aliases:** Providers have both an ID (`claude`, `github`) and a short alias (`cc`, `gh`). Models are referenced as `alias/model-name` (e.g., `cc/claude-opus-4-6`).
+
+3. **The `open-sse/` directory is a separate npm workspace** with its own config, handlers, and translators. It handles the actual SSE streaming and format translation.
+
+4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
+
+5. **Database migrations:** SQLite schema is managed inline in `src/lib/db/core.ts` and `src/lib/db/providers.ts`. No migration framework — schema changes are applied on startup.
+
+6. **Tests use Node.js built-in test runner:** Run `npm test` or `node --test tests/unit/*.test.mjs`. Playwright is used for E2E tests.
+
+7. **The proxy pipeline is in `src/sse/`**, not in `src/app/api/v1/`. The API routes in `src/app/api/v1/` delegate to the SSE server running on a separate Express instance.
+
+## Links
+
+- Repository: https://github.com/diegosouzapw/OmniRoute
+- Website: https://omniroute.online
+- npm: https://www.npmjs.com/package/omniroute
+- Docker Hub: https://hub.docker.com/r/diegosouzapw/omniroute
+- Documentation: See `/docs/` directory

next.config.mjs

@@ -2,12 +2,12 @@
 const nextConfig = {
   turbopack: {},
   output: "standalone",
+  serverExternalPackages: ["better-sqlite3"],
   transpilePackages: ["@omniroute/open-sse"],
   allowedDevOrigins: ["192.168.*"],
   typescript: {
-    // Migration Phase: ignore TS errors during build.
-    // Remove after all 984 type errors are resolved.
-    ignoreBuildErrors: true,
+    // All TS errors resolved — strict checking enforced
+    ignoreBuildErrors: false,
   },
   images: {
     unoptimized: true,

open-sse/config/providerRegistry.ts

@@ -43,6 +43,7 @@ export interface RegistryEntry {
   extraHeaders?: Record<string, string>;
   oauth?: RegistryOAuth;
   models: RegistryModel[];
+  modelsUrl?: string;
   chatPath?: string;
   clientVersion?: string;
   passthroughModels?: boolean;
@@ -107,7 +108,7 @@ export const REGISTRY: Record<string, RegistryEntry> = {
       clientIdEnv: "GEMINI_OAUTH_CLIENT_ID",
       clientIdDefault: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
       clientSecretEnv: "GEMINI_OAUTH_CLIENT_SECRET",
-      clientSecretDefault: "",
+      clientSecretDefault: "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",
     },
     models: [
       { id: "gemini-3-pro-preview", name: "Gemini 3 Pro Preview" },
@@ -133,7 +134,7 @@ export const REGISTRY: Record<string, RegistryEntry> = {
       clientIdEnv: "GEMINI_CLI_OAUTH_CLIENT_ID",
       clientIdDefault: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
       clientSecretEnv: "GEMINI_CLI_OAUTH_CLIENT_SECRET",
-      clientSecretDefault: "",
+      clientSecretDefault: "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",
     },
     models: [
       { id: "gemini-3-flash-preview", name: "Gemini 3 Flash Preview" },
@@ -211,7 +212,7 @@ export const REGISTRY: Record<string, RegistryEntry> = {
     id: "iflow",
     alias: "if",
     format: "openai",
-    executor: "default",
+    executor: "iflow",
     baseUrl: "https://apis.iflow.cn/v1/chat/completions",
     authType: "oauth",
     authHeader: "bearer",
@@ -222,7 +223,7 @@ export const REGISTRY: Record<string, RegistryEntry> = {
       clientIdEnv: "IFLOW_OAUTH_CLIENT_ID",
       clientIdDefault: "10009311001",
       clientSecretEnv: "IFLOW_OAUTH_CLIENT_SECRET",
-      clientSecretDefault: "",
+      clientSecretDefault: "4Z3YjXycVsQvyGF1etiNlIBB4RsqSDtW",
       tokenUrl: "https://iflow.cn/oauth/token",
       authUrl: "https://iflow.cn/oauth",
     },
@@ -260,7 +261,7 @@ export const REGISTRY: Record<string, RegistryEntry> = {
       clientIdEnv: "ANTIGRAVITY_OAUTH_CLIENT_ID",
       clientIdDefault: "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com",
       clientSecretEnv: "ANTIGRAVITY_OAUTH_CLIENT_SECRET",
-      clientSecretDefault: "",
+      clientSecretDefault: "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",
     },
     models: [
       { id: "claude-opus-4-6-thinking", name: "Claude Opus 4.6 Thinking" },
@@ -503,6 +504,7 @@ export const REGISTRY: Record<string, RegistryEntry> = {
     format: "openrouter",
     executor: "openrouter",
     baseUrl: "https://api.kilo.ai/api/openrouter/chat/completions",
+    modelsUrl: "https://api.kilo.ai/api/openrouter/models",
     authType: "oauth",
     authHeader: "Authorization",
     authPrefix: "Bearer ",
@@ -511,14 +513,32 @@ export const REGISTRY: Record<string, RegistryEntry> = {
       pollUrlBase: "https://api.kilo.ai/api/device-auth/codes",
     },
     models: [
-      { id: "anthropic/claude-sonnet-4-20250514", name: "Claude Sonnet 4" },
-      { id: "anthropic/claude-opus-4-20250514", name: "Claude Opus 4" },
-      { id: "google/gemini-2.5-pro", name: "Gemini 2.5 Pro" },
-      { id: "google/gemini-2.5-flash", name: "Gemini 2.5 Flash" },
-      { id: "openai/gpt-4.1", name: "GPT-4.1" },
-      { id: "openai/o3", name: "o3" },
-      { id: "deepseek/deepseek-chat", name: "DeepSeek Chat" },
-      { id: "deepseek/deepseek-reasoner", name: "DeepSeek Reasoner" },
+      { id: "openrouter/free", name: "Free Models Router" },
+      { id: "qwen/qwen3-vl-235b-a22b-thinking", name: "Qwen3 VL 235B A22B Thinking" },
+      { id: "qwen/qwen3-235b-a22b-thinking-2507", name: "Qwen3 235B A22B Thinking 2507" },
+      { id: "qwen/qwen3-vl-30b-a3b-thinking", name: "Qwen3 VL 30B A3B Thinking" },
+      { id: "stepfun/step-3.5-flash:free", name: "StepFun Step 3.5 Flash" },
+      { id: "arcee-ai/trinity-large-preview:free", name: "Arcee AI Trinity Large Preview" },
+      { id: "openai/gpt-4o-mini", name: "GPT-4o Mini" },
+      { id: "openai/gpt-4.1-nano", name: "GPT-4.1 Nano" },
+      { id: "openai/gpt-5-nano", name: "GPT-5 Nano" },
+      { id: "openai/gpt-5-mini", name: "GPT-5 Mini" },
+      { id: "anthropic/claude-3-haiku", name: "Claude 3 Haiku" },
+      { id: "google/gemini-2.0-flash", name: "Gemini 2.0 Flash" },
+      { id: "google/gemini-2.5-flash-lite", name: "Gemini 2.5 Flash Lite" },
+      { id: "deepseek/deepseek-chat-v3.1", name: "DeepSeek V3.1" },
+      { id: "deepseek/deepseek-v3.2", name: "DeepSeek V3.2" },
+      { id: "meta-llama/llama-3.3-70b-instruct", name: "Llama 3.3 70B" },
+      { id: "meta-llama/llama-4-scout", name: "Llama 4 Scout" },
+      { id: "meta-llama/llama-4-maverick", name: "Llama 4 Maverick" },
+      { id: "qwen/qwen3-8b", name: "Qwen3 8B" },
+      { id: "qwen/qwen3-32b", name: "Qwen3 32B" },
+      { id: "qwen/qwen3-coder", name: "Qwen3 Coder 480B" },
+      { id: "qwen/qwq-32b", name: "QwQ 32B" },
+      { id: "mistralai/mistral-small-24b-instruct-2501", name: "Mistral Small 3" },
+      { id: "mistralai/mistral-7b-instruct", name: "Mistral 7B" },
+      { id: "x-ai/grok-code-fast-1", name: "Grok Code Fast 1" },
+      { id: "moonshotai/kimi-k2.5", name: "Kimi K2.5" },
     ],
     passthroughModels: true,
   },

open-sse/executors/codex.ts

@@ -4,7 +4,8 @@ import { PROVIDERS } from "../config/constants.ts";
 
 /**
  * Codex Executor - handles OpenAI Codex API (Responses API format)
- * Automatically injects default instructions if missing
+ * Automatically injects default instructions if missing.
+ * IMPORTANT: Includes chatgpt-account-id header for workspace binding.
  */
 export class CodexExecutor extends BaseExecutor {
   constructor() {
@@ -14,9 +15,18 @@ export class CodexExecutor extends BaseExecutor {
   /**
    * Codex Responses endpoint is SSE-first.
    * Always request event-stream from upstream, even when client requested stream=false.
+   * Includes chatgpt-account-id header for strict workspace binding.
    */
   buildHeaders(credentials, stream = true) {
-    return super.buildHeaders(credentials, true);
+    const headers = super.buildHeaders(credentials, true);
+
+    // Add workspace binding header if workspaceId is persisted
+    const workspaceId = credentials?.providerSpecificData?.workspaceId;
+    if (workspaceId) {
+      headers["chatgpt-account-id"] = workspaceId;
+    }
+
+    return headers;
   }
 
   /**

open-sse/executors/iflow.ts

@@ -0,0 +1,97 @@
+import crypto from "crypto";
+import { BaseExecutor } from "./base.ts";
+import { PROVIDERS } from "../config/constants.ts";
+
+/**
+ * IFlowExecutor - Executor for iFlow API with HMAC-SHA256 signature.
+ *
+ * iFlow requires custom headers including a session ID, timestamp,
+ * and an HMAC-SHA256 signature for request authentication.
+ * Without these headers, the API returns a 406 error.
+ *
+ * Fixes: https://github.com/diegosouzapw/OmniRoute/issues/114
+ */
+export class IFlowExecutor extends BaseExecutor {
+  constructor() {
+    super("iflow", PROVIDERS.iflow);
+  }
+
+  /**
+   * Create iFlow signature using HMAC-SHA256
+   * @param userAgent - User agent string
+   * @param sessionID - Session ID
+   * @param timestamp - Unix timestamp in milliseconds
+   * @param apiKey - API key for signing
+   * @returns Hex-encoded signature
+   */
+  createIFlowSignature(
+    userAgent: string,
+    sessionID: string,
+    timestamp: number,
+    apiKey: string
+  ): string {
+    if (!apiKey) return "";
+    const payload = `${userAgent}:${sessionID}:${timestamp}`;
+    const hmac = crypto.createHmac("sha256", apiKey);
+    hmac.update(payload);
+    return hmac.digest("hex");
+  }
+
+  /**
+   * Build headers with iFlow-specific HMAC-SHA256 signature.
+   * Includes session-id, x-iflow-timestamp, and x-iflow-signature.
+   */
+  buildHeaders(credentials: any, stream = true) {
+    // Generate session ID and timestamp
+    const sessionID = `session-${crypto.randomUUID()}`;
+    const timestamp = Date.now();
+
+    // Get user agent from config
+    const userAgent = this.config.headers?.["User-Agent"] || "iFlow-Cli";
+
+    // Get API key (prefer apiKey, fallback to accessToken)
+    const apiKey = credentials.apiKey || credentials.accessToken || "";
+
+    // Create HMAC-SHA256 signature
+    const signature = this.createIFlowSignature(userAgent, sessionID, timestamp, apiKey);
+
+    // Build headers
+    const headers: Record<string, string> = {
+      "Content-Type": "application/json",
+      ...this.config.headers,
+      "session-id": sessionID,
+      "x-iflow-timestamp": timestamp.toString(),
+      "x-iflow-signature": signature,
+    };
+
+    // Add authorization
+    if (credentials.apiKey) {
+      headers["Authorization"] = `Bearer ${credentials.apiKey}`;
+    } else if (credentials.accessToken) {
+      headers["Authorization"] = `Bearer ${credentials.accessToken}`;
+    }
+
+    // Add streaming header
+    if (stream) {
+      headers["Accept"] = "text/event-stream";
+    }
+
+    return headers;
+  }
+
+  /**
+   * Build URL for iFlow API — uses baseUrl directly.
+   */
+  buildUrl(model: string, stream: boolean, urlIndex = 0, credentials: any = null) {
+    return this.config.baseUrl;
+  }
+
+  /**
+   * Transform request body (passthrough for iFlow).
+   */
+  transformRequest(model: string, body: any, stream: boolean, credentials: any) {
+    return body;
+  }
+}
+
+export default IFlowExecutor;

open-sse/executors/index.ts

@@ -1,6 +1,7 @@
 import { AntigravityExecutor } from "./antigravity.ts";
 import { GeminiCLIExecutor } from "./gemini-cli.ts";
 import { GithubExecutor } from "./github.ts";
+import { IFlowExecutor } from "./iflow.ts";
 import { KiroExecutor } from "./kiro.ts";
 import { CodexExecutor } from "./codex.ts";
 import { CursorExecutor } from "./cursor.ts";
@@ -10,6 +11,7 @@ const executors = {
   antigravity: new AntigravityExecutor(),
   "gemini-cli": new GeminiCLIExecutor(),
   github: new GithubExecutor(),
+  iflow: new IFlowExecutor(),
   kiro: new KiroExecutor(),
   codex: new CodexExecutor(),
   cursor: new CursorExecutor(),
@@ -32,6 +34,7 @@ export { BaseExecutor } from "./base.ts";
 export { AntigravityExecutor } from "./antigravity.ts";
 export { GeminiCLIExecutor } from "./gemini-cli.ts";
 export { GithubExecutor } from "./github.ts";
+export { IFlowExecutor } from "./iflow.ts";
 export { KiroExecutor } from "./kiro.ts";
 export { CodexExecutor } from "./codex.ts";
 export { CursorExecutor } from "./cursor.ts";

open-sse/handlers/audioSpeech.ts

@@ -1,3 +1,4 @@
+import { getCorsOrigin } from "../utils/cors.ts";
 /**
  * Audio Speech Handler (TTS)
  *
@@ -40,7 +41,10 @@ async function handleHyperbolicSpeech(providerConfig, body, token) {
     const errText = await res.text();
     return new Response(errText, {
       status: res.status,
-      headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" },
+      headers: {
+        "Content-Type": "application/json",
+        "Access-Control-Allow-Origin": getCorsOrigin(),
+      },
     });
   }
 
@@ -52,7 +56,7 @@ async function handleHyperbolicSpeech(providerConfig, body, token) {
     status: 200,
     headers: {
       "Content-Type": "audio/mpeg",
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": getCorsOrigin(),
     },
   });
 }
@@ -77,7 +81,10 @@ async function handleDeepgramSpeech(providerConfig, body, modelId, token) {
     const errText = await res.text();
     return new Response(errText, {
       status: res.status,
-      headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" },
+      headers: {
+        "Content-Type": "application/json",
+        "Access-Control-Allow-Origin": getCorsOrigin(),
+      },
     });
   }
 
@@ -86,7 +93,7 @@ async function handleDeepgramSpeech(providerConfig, body, modelId, token) {
     status: 200,
     headers: {
       "Content-Type": contentType,
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": getCorsOrigin(),
       "Transfer-Encoding": "chunked",
     },
   });
@@ -154,7 +161,10 @@ export async function handleAudioSpeech({ body, credentials }) {
       const errText = await res.text();
       return new Response(errText, {
         status: res.status,
-        headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" },
+        headers: {
+          "Content-Type": "application/json",
+          "Access-Control-Allow-Origin": getCorsOrigin(),
+        },
       });
     }
 
@@ -164,7 +174,7 @@ export async function handleAudioSpeech({ body, credentials }) {
       status: 200,
       headers: {
         "Content-Type": contentType,
-        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Origin": getCorsOrigin(),
         "Transfer-Encoding": "chunked",
       },
     });

open-sse/handlers/audioTranscription.ts

@@ -1,3 +1,4 @@
+import { getCorsOrigin } from "../utils/cors.ts";
 /**
  * Audio Transcription Handler
  *
@@ -46,7 +47,10 @@ async function handleDeepgramTranscription(providerConfig, file, modelId, token)
     const errText = await res.text();
     return new Response(errText, {
       status: res.status,
-      headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" },
+      headers: {
+        "Content-Type": "application/json",
+        "Access-Control-Allow-Origin": getCorsOrigin(),
+      },
     });
   }
 
@@ -54,7 +58,7 @@ async function handleDeepgramTranscription(providerConfig, file, modelId, token)
   // Transform Deepgram response to OpenAI Whisper format
   const text = data.results?.channels?.[0]?.alternatives?.[0]?.transcript || "";
 
-  return Response.json({ text }, { headers: { "Access-Control-Allow-Origin": "*" } });
+  return Response.json({ text }, { headers: { "Access-Control-Allow-Origin": getCorsOrigin() } });
 }
 
 /**
@@ -78,7 +82,10 @@ async function handleAssemblyAITranscription(providerConfig, file, modelId, toke
     const errText = await uploadRes.text();
     return new Response(errText, {
       status: uploadRes.status,
-      headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" },
+      headers: {
+        "Content-Type": "application/json",
+        "Access-Control-Allow-Origin": getCorsOrigin(),
+      },
     });
   }
 
@@ -102,7 +109,10 @@ async function handleAssemblyAITranscription(providerConfig, file, modelId, toke
     const errText = await submitRes.text();
     return new Response(errText, {
       status: submitRes.status,
-      headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" },
+      headers: {
+        "Content-Type": "application/json",
+        "Access-Control-Allow-Origin": getCorsOrigin(),
+      },
     });
   }
 
@@ -124,7 +134,7 @@ async function handleAssemblyAITranscription(providerConfig, file, modelId, toke
     if (result.status === "completed") {
       return Response.json(
         { text: result.text || "" },
-        { headers: { "Access-Control-Allow-Origin": "*" } }
+        { headers: { "Access-Control-Allow-Origin": getCorsOrigin() } }
       );
     }
 
@@ -182,7 +192,11 @@ export async function handleAudioTranscription({ formData, credentials }) {
 
   // Default: OpenAI/Groq-compatible multipart proxy
   const upstreamForm = new FormData();
-  upstreamForm.append("file", /** @type {Blob} */ (file), /** @type {any} */ (file).name || "audio.wav");
+  upstreamForm.append(
+    "file",
+    /** @type {Blob} */ file,
+    /** @type {any} */ file.name || "audio.wav"
+  );
   upstreamForm.append("model", modelId);
 
   // Forward optional parameters
@@ -195,7 +209,7 @@ export async function handleAudioTranscription({ formData, credentials }) {
   ]) {
     const val = formData.get(key);
     if (val !== null && val !== undefined) {
-      upstreamForm.append(key, /** @type {string} */ (val));
+      upstreamForm.append(key, /** @type {string} */ val);
     }
   }
 
@@ -210,7 +224,10 @@ export async function handleAudioTranscription({ formData, credentials }) {
       const errText = await res.text();
       return new Response(errText, {
         status: res.status,
-        headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" },
+        headers: {
+          "Content-Type": "application/json",
+          "Access-Control-Allow-Origin": getCorsOrigin(),
+        },
       });
     }
 
@@ -219,7 +236,7 @@ export async function handleAudioTranscription({ formData, credentials }) {
 
     return new Response(data, {
       status: 200,
-      headers: { "Content-Type": contentType, "Access-Control-Allow-Origin": "*" },
+      headers: { "Content-Type": contentType, "Access-Control-Allow-Origin": getCorsOrigin() },
     });
   } catch (err) {
     return errorResponse(500, `Transcription request failed: ${err.message}`);

open-sse/handlers/chatCore.ts

@@ -1,3 +1,4 @@
+import { getCorsOrigin } from "../utils/cors.ts";
 import { detectFormat, getTargetFormat } from "../services/provider.ts";
 import { translateRequest, needsTranslation } from "../translator/index.ts";
 import { FORMATS } from "../translator/formats.ts";
@@ -24,6 +25,7 @@ import { getExecutor } from "../executors/index.ts";
 import { translateNonStreamingResponse } from "./responseTranslator.ts";
 import { extractUsageFromResponse } from "./usageExtractor.ts";
 import { parseSSEToOpenAIResponse, parseSSEToResponsesOutput } from "./sseParser.ts";
+import { sanitizeOpenAIResponse } from "./responseSanitizer.ts";
 import {
   withRateLimit,
   updateFromHeaders,
@@ -81,7 +83,7 @@ export async function handleChatCore({
         status: cachedIdemp.status,
         headers: {
           "Content-Type": "application/json",
-          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Origin": getCorsOrigin(),
           "X-OmniRoute-Idempotent": "true",
         },
       }),
@@ -108,8 +110,8 @@ export async function handleChatCore({
   const modelTargetFormat = getModelTargetFormat(alias, model);
   const targetFormat = modelTargetFormat || getTargetFormat(provider);
 
-  // Default to streaming unless client explicitly sets stream: false
-  const stream = body.stream !== false;
+  // Default to false unless client explicitly sets stream: true (OpenAI spec compliant)
+  const stream = body.stream === true;
 
   // ── Phase 9.1: Semantic cache check (non-streaming, temp=0 only) ──
   if (isCacheable(body, clientRawRequest?.headers)) {
@@ -122,7 +124,7 @@ export async function handleChatCore({
         response: new Response(JSON.stringify(cached), {
           headers: {
             "Content-Type": "application/json",
-            "Access-Control-Allow-Origin": "*",
+            "Access-Control-Allow-Origin": getCorsOrigin(),
             "X-OmniRoute-Cache": "HIT",
           },
         }),
@@ -188,7 +190,7 @@ export async function handleChatCore({
             status: statusCode,
             headers: {
               "Content-Type": "application/json",
-              "Access-Control-Allow-Origin": "*",
+              "Access-Control-Allow-Origin": getCorsOrigin(),
             },
           }
         ),
@@ -471,10 +473,17 @@ export async function handleChatCore({
     }
 
     // Translate response to client's expected format (usually OpenAI)
-    const translatedResponse = needsTranslation(targetFormat, sourceFormat)
+    let translatedResponse = needsTranslation(targetFormat, sourceFormat)
       ? translateNonStreamingResponse(responseBody, targetFormat, sourceFormat)
       : responseBody;
 
+    // Sanitize response for OpenAI SDK compatibility
+    // Strips non-standard fields (x_groq, usage_breakdown, service_tier, etc.)
+    // Extracts <think> tags into reasoning_content
+    if (sourceFormat === FORMATS.OPENAI) {
+      translatedResponse = sanitizeOpenAIResponse(translatedResponse);
+    }
+
     // Add buffer and filter usage for client (to prevent CLI context errors)
     if (translatedResponse?.usage) {
       const buffered = addBufferToUsage(translatedResponse.usage);
@@ -506,7 +515,7 @@ export async function handleChatCore({
       response: new Response(JSON.stringify(translatedResponse), {
         headers: {
           "Content-Type": "application/json",
-          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Origin": getCorsOrigin(),
           "X-OmniRoute-Cache": "MISS",
         },
       }),
@@ -524,7 +533,7 @@ export async function handleChatCore({
     "Content-Type": "text/event-stream",
     "Cache-Control": "no-cache",
     Connection: "keep-alive",
-    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Origin": getCorsOrigin(),
   };
 
   // Create transform stream with logger for streaming response

open-sse/handlers/moderations.ts

@@ -1,3 +1,4 @@
+import { getCorsOrigin } from "../utils/cors.ts";
 /**
  * Moderation Handler
  *
@@ -55,13 +56,16 @@ export async function handleModeration({ body, credentials }) {
       const errText = await res.text();
       return new Response(errText, {
         status: res.status,
-        headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" },
+        headers: {
+          "Content-Type": "application/json",
+          "Access-Control-Allow-Origin": getCorsOrigin(),
+        },
       });
     }
 
     const data = await res.json();
     return Response.json(data, {
-      headers: { "Access-Control-Allow-Origin": "*" },
+      headers: { "Access-Control-Allow-Origin": getCorsOrigin() },
     });
   } catch (err) {
     return errorResponse(500, `Moderation request failed: ${err.message}`);

open-sse/handlers/rerank.ts

@@ -1,3 +1,4 @@
+import { getCorsOrigin } from "../utils/cors.ts";
 /**
  * Rerank Handler
  *
@@ -129,7 +130,7 @@ export async function handleRerank({
     const result = transformResponseFromProvider(providerConfig, data);
 
     return Response.json(result, {
-      headers: { "Access-Control-Allow-Origin": "*" },
+      headers: { "Access-Control-Allow-Origin": getCorsOrigin() },
     });
   } catch (err) {
     return errorResponse(500, `Rerank request failed: ${err.message}`);

open-sse/handlers/responseSanitizer.ts

@@ -0,0 +1,269 @@
+/**
+ * Response Sanitizer — Normalizes LLM responses to strict OpenAI SDK format.
+ *
+ * Fixes Issues:
+ * 1. Strips non-standard fields (x_groq, usage_breakdown, service_tier) that
+ *    break OpenAI Python SDK v1.83+ Pydantic validation (returns str instead of object)
+ * 2. Extracts <think> tags from thinking models into reasoning_content
+ * 3. Normalizes response id, object, and usage fields
+ * 4. Converts developer role → system for non-OpenAI providers
+ */
+
+// ── Standard OpenAI ChatCompletion fields ──────────────────────────────────
+const ALLOWED_TOP_LEVEL_FIELDS = new Set([
+  "id",
+  "object",
+  "created",
+  "model",
+  "choices",
+  "usage",
+  "system_fingerprint",
+]);
+
+const ALLOWED_USAGE_FIELDS = new Set([
+  "prompt_tokens",
+  "completion_tokens",
+  "total_tokens",
+  "prompt_tokens_details",
+  "completion_tokens_details",
+]);
+
+const ALLOWED_MESSAGE_FIELDS = new Set([
+  "role",
+  "content",
+  "tool_calls",
+  "function_call",
+  "refusal",
+  "reasoning_content",
+]);
+
+const ALLOWED_CHOICE_FIELDS = new Set(["index", "message", "delta", "finish_reason", "logprobs"]);
+
+// ── Think tag regex ────────────────────────────────────────────────────────
+// Matches <think>...</think> blocks (greedy, dotAll)
+const THINK_TAG_REGEX = /<think>([\s\S]*?)<\/think>/gi;
+
+/**
+ * Extract <think> blocks from text content and return separated parts.
+ * @returns {{ content: string, thinking: string | null }}
+ */
+export function extractThinkingFromContent(text: string): {
+  content: string;
+  thinking: string | null;
+} {
+  if (!text || typeof text !== "string") {
+    return { content: text || "", thinking: null };
+  }
+
+  const thinkingParts: string[] = [];
+  let hasThinkTags = false;
+
+  const cleaned = text.replace(THINK_TAG_REGEX, (_, thinkContent) => {
+    hasThinkTags = true;
+    const trimmed = thinkContent.trim();
+    if (trimmed) {
+      thinkingParts.push(trimmed);
+    }
+    return "";
+  });
+
+  if (!hasThinkTags) {
+    return { content: text, thinking: null };
+  }
+
+  return {
+    content: cleaned.trim(),
+    thinking: thinkingParts.length > 0 ? thinkingParts.join("\n\n") : null,
+  };
+}
+
+/**
+ * Sanitize a non-streaming OpenAI ChatCompletion response.
+ * Strips non-standard fields and normalizes required fields.
+ */
+export function sanitizeOpenAIResponse(body: any): any {
+  if (!body || typeof body !== "object") return body;
+
+  // Build sanitized response with only allowed top-level fields
+  const sanitized: Record<string, any> = {};
+
+  // Ensure required fields exist
+  sanitized.id = normalizeResponseId(body.id);
+  sanitized.object = body.object || "chat.completion";
+  sanitized.created = body.created || Math.floor(Date.now() / 1000);
+  sanitized.model = body.model || "unknown";
+
+  // Sanitize choices
+  if (Array.isArray(body.choices)) {
+    sanitized.choices = body.choices.map((choice: any, idx: number) => sanitizeChoice(choice, idx));
+  } else {
+    sanitized.choices = [];
+  }
+
+  // Sanitize usage
+  if (body.usage && typeof body.usage === "object") {
+    sanitized.usage = sanitizeUsage(body.usage);
+  }
+
+  // Keep system_fingerprint if present (it's a valid OpenAI field)
+  if (body.system_fingerprint) {
+    sanitized.system_fingerprint = body.system_fingerprint;
+  }
+
+  return sanitized;
+}
+
+/**
+ * Sanitize a single choice object.
+ */
+function sanitizeChoice(choice: any, defaultIndex: number): any {
+  const sanitized: Record<string, any> = {
+    index: choice.index ?? defaultIndex,
+    finish_reason: choice.finish_reason || null,
+  };
+
+  // Sanitize message (non-streaming) or delta (streaming)
+  if (choice.message) {
+    sanitized.message = sanitizeMessage(choice.message);
+  }
+  if (choice.delta) {
+    sanitized.delta = sanitizeMessage(choice.delta);
+  }
+
+  // Keep logprobs if present
+  if (choice.logprobs !== undefined) {
+    sanitized.logprobs = choice.logprobs;
+  }
+
+  return sanitized;
+}
+
+/**
+ * Sanitize a message object, extracting <think> tags if present.
+ */
+function sanitizeMessage(msg: any): any {
+  if (!msg || typeof msg !== "object") return msg;
+
+  const sanitized: Record<string, any> = {};
+
+  // Copy only allowed fields
+  if (msg.role) sanitized.role = msg.role;
+  if (msg.refusal !== undefined) sanitized.refusal = msg.refusal;
+
+  // Handle content — extract <think> tags
+  if (typeof msg.content === "string") {
+    const { content, thinking } = extractThinkingFromContent(msg.content);
+    sanitized.content = content;
+
+    // Set reasoning_content from <think> tags (if not already set)
+    if (thinking && !msg.reasoning_content) {
+      sanitized.reasoning_content = thinking;
+    }
+  } else if (msg.content !== undefined) {
+    sanitized.content = msg.content;
+  }
+
+  // Preserve existing reasoning_content (from providers that natively support it)
+  if (msg.reasoning_content && !sanitized.reasoning_content) {
+    sanitized.reasoning_content = msg.reasoning_content;
+  }
+
+  // Preserve tool_calls
+  if (msg.tool_calls) {
+    sanitized.tool_calls = msg.tool_calls;
+  }
+
+  // Preserve function_call (legacy)
+  if (msg.function_call) {
+    sanitized.function_call = msg.function_call;
+  }
+
+  return sanitized;
+}
+
+/**
+ * Sanitize usage object — keep only standard fields.
+ */
+function sanitizeUsage(usage: any): any {
+  if (!usage || typeof usage !== "object") return usage;
+
+  const sanitized: Record<string, any> = {};
+  for (const key of ALLOWED_USAGE_FIELDS) {
+    if (usage[key] !== undefined) {
+      sanitized[key] = usage[key];
+    }
+  }
+
+  // Ensure required fields
+  if (sanitized.prompt_tokens === undefined) sanitized.prompt_tokens = 0;
+  if (sanitized.completion_tokens === undefined) sanitized.completion_tokens = 0;
+  if (sanitized.total_tokens === undefined) {
+    sanitized.total_tokens = sanitized.prompt_tokens + sanitized.completion_tokens;
+  }
+
+  return sanitized;
+}
+
+/**
+ * Normalize response ID to use chatcmpl- prefix.
+ */
+function normalizeResponseId(id: any): string {
+  if (!id || typeof id !== "string") {
+    return `chatcmpl-${crypto.randomUUID().replace(/-/g, "").slice(0, 29)}`;
+  }
+  // Already correct format
+  if (id.startsWith("chatcmpl-")) return id;
+  // Keep custom IDs but don't break them
+  return id;
+}
+
+/**
+ * Sanitize a streaming SSE chunk for passthrough mode.
+ * Lighter than full sanitization — only strips problematic extra fields.
+ */
+export function sanitizeStreamingChunk(parsed: any): any {
+  if (!parsed || typeof parsed !== "object") return parsed;
+
+  // Build sanitized chunk
+  const sanitized: Record<string, any> = {};
+
+  // Keep only standard fields
+  if (parsed.id !== undefined) sanitized.id = parsed.id;
+  sanitized.object = parsed.object || "chat.completion.chunk";
+  if (parsed.created !== undefined) sanitized.created = parsed.created;
+  if (parsed.model !== undefined) sanitized.model = parsed.model;
+
+  // Sanitize choices with delta
+  if (Array.isArray(parsed.choices)) {
+    sanitized.choices = parsed.choices.map((choice: any) => {
+      const c: Record<string, any> = {
+        index: choice.index ?? 0,
+      };
+      if (choice.delta !== undefined) {
+        c.delta = {};
+        const delta = choice.delta;
+        if (delta.role !== undefined) c.delta.role = delta.role;
+        if (delta.content !== undefined) c.delta.content = delta.content;
+        if (delta.reasoning_content !== undefined)
+          c.delta.reasoning_content = delta.reasoning_content;
+        if (delta.tool_calls !== undefined) c.delta.tool_calls = delta.tool_calls;
+        if (delta.function_call !== undefined) c.delta.function_call = delta.function_call;
+      }
+      if (choice.finish_reason !== undefined) c.finish_reason = choice.finish_reason;
+      if (choice.logprobs !== undefined) c.logprobs = choice.logprobs;
+      return c;
+    });
+  }
+
+  // Sanitize usage if present
+  if (parsed.usage && typeof parsed.usage === "object") {
+    sanitized.usage = sanitizeUsage(parsed.usage);
+  }
+
+  // Keep system_fingerprint if present
+  if (parsed.system_fingerprint) {
+    sanitized.system_fingerprint = parsed.system_fingerprint;
+  }
+
+  return sanitized;
+}

open-sse/handlers/responsesHandler.ts

@@ -1,3 +1,4 @@
+import { getCorsOrigin } from "../utils/cors.ts";
 /**
  * Responses API Handler for Workers
  * Converts Chat Completions to Codex Responses API format
@@ -75,7 +76,7 @@ export async function handleResponsesCore({
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache",
         Connection: "keep-alive",
-        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Origin": getCorsOrigin(),
       },
     }),
   };

open-sse/services/roleNormalizer.ts

@@ -0,0 +1,169 @@
+/**
+ * Role Normalizer — Converts message roles for provider compatibility.
+ *
+ * Fixes Issues:
+ * 1. GLM/ZhipuAI rejects `system` role → merged into first `user` message
+ * 2. OpenAI `developer` role not understood by non-OpenAI providers → normalized to `system`
+ * 3. Some providers don't support `system` role at all → prepended to user message
+ *
+ * Provider capability matrix is defined here rather than in the registry to
+ * avoid breaking changes to the existing RegistryEntry interface.
+ */
+
+// ── Provider capabilities ──────────────────────────────────────────────────
+
+/**
+ * Providers that do NOT support the `system` role in messages.
+ * For these, system messages are merged into the first user message.
+ *
+ * Note: This applies only to OpenAI-format passthrough providers.
+ * Claude and Gemini have their own system message handling in dedicated translators.
+ */
+const PROVIDERS_WITHOUT_SYSTEM_ROLE = new Set([
+  // Known to reject system role (from troubleshooting report)
+  // GLM uses Claude format, so this is handled through claude translator
+  // But if accessed through OpenAI-format providers like nvidia, it needs this:
+]);
+
+/**
+ * Models that are known to reject the `system` role regardless of provider.
+ * Uses prefix matching (e.g., "glm-" matches "glm-4.7", "glm-4.5", etc.)
+ */
+const MODELS_WITHOUT_SYSTEM_ROLE = [
+  "glm-", // ZhipuAI GLM models
+  "ernie-", // Baidu ERNIE models
+];
+
+/**
+ * Check if a provider+model combo supports the system role.
+ */
+function supportsSystemRole(provider: string, model: string): boolean {
+  if (PROVIDERS_WITHOUT_SYSTEM_ROLE.has(provider)) return false;
+
+  const modelLower = (model || "").toLowerCase();
+  for (const prefix of MODELS_WITHOUT_SYSTEM_ROLE) {
+    if (modelLower.startsWith(prefix)) return false;
+  }
+
+  return true;
+}
+
+/**
+ * Normalize the `developer` role to `system` for non-OpenAI providers.
+ * OpenAI introduced `developer` as a replacement for `system` in newer models,
+ * but most other providers still expect `system`.
+ *
+ * @param messages - Array of messages
+ * @param targetFormat - The target format (e.g., "openai", "claude", "gemini")
+ * @returns Modified messages array
+ */
+export function normalizeDeveloperRole(messages: any[], targetFormat: string): any[] {
+  if (!Array.isArray(messages)) return messages;
+
+  // For OpenAI format, keep developer role as-is (it's valid)
+  // For all other formats, convert developer → system
+  if (targetFormat === "openai") return messages;
+
+  return messages.map((msg) => {
+    if (msg.role === "developer") {
+      return { ...msg, role: "system" };
+    }
+    return msg;
+  });
+}
+
+/**
+ * Convert `system` messages to user messages for providers that don't support
+ * the system role. The system content is prepended to the first user message
+ * with a clear delimiter.
+ *
+ * @param messages - Array of messages
+ * @param provider - Provider name
+ * @param model - Model name
+ * @returns Modified messages array
+ */
+export function normalizeSystemRole(messages: any[], provider: string, model: string): any[] {
+  if (!Array.isArray(messages) || messages.length === 0) return messages;
+  if (supportsSystemRole(provider, model)) return messages;
+
+  // Extract system messages
+  const systemMessages = messages.filter((m) => m.role === "system" || m.role === "developer");
+  if (systemMessages.length === 0) return messages;
+
+  // Build system content string
+  const systemContent = systemMessages
+    .map((m) => {
+      if (typeof m.content === "string") return m.content;
+      if (Array.isArray(m.content)) {
+        return m.content
+          .filter((c: any) => c.type === "text")
+          .map((c: any) => c.text)
+          .join("\n");
+      }
+      return "";
+    })
+    .filter(Boolean)
+    .join("\n\n");
+
+  if (!systemContent) {
+    return messages.filter((m) => m.role !== "system" && m.role !== "developer");
+  }
+
+  // Remove system messages and merge into first user message
+  const nonSystemMessages = messages.filter((m) => m.role !== "system" && m.role !== "developer");
+
+  // Find first user message and prepend system content
+  const firstUserIdx = nonSystemMessages.findIndex((m) => m.role === "user");
+  if (firstUserIdx >= 0) {
+    const userMsg = nonSystemMessages[firstUserIdx];
+    const userContent =
+      typeof userMsg.content === "string"
+        ? userMsg.content
+        : Array.isArray(userMsg.content)
+          ? userMsg.content
+              .filter((c: any) => c.type === "text")
+              .map((c: any) => c.text)
+              .join("\n")
+          : "";
+
+    nonSystemMessages[firstUserIdx] = {
+      ...userMsg,
+      content: `[System Instructions]\n${systemContent}\n\n[User Message]\n${userContent}`,
+    };
+  } else {
+    // No user message found — insert as a user message at the beginning
+    nonSystemMessages.unshift({
+      role: "user",
+      content: `[System Instructions]\n${systemContent}`,
+    });
+  }
+
+  return nonSystemMessages;
+}
+
+/**
+ * Full role normalization pipeline.
+ * Call this before sending the request to the provider.
+ *
+ * @param messages - Array of messages
+ * @param provider - Provider name/id
+ * @param model - Model name
+ * @param targetFormat - Target API format
+ * @returns Normalized messages array
+ */
+export function normalizeRoles(
+  messages: any[],
+  provider: string,
+  model: string,
+  targetFormat: string
+): any[] {
+  if (!Array.isArray(messages)) return messages;
+
+  // Step 1: Normalize developer → system (for non-OpenAI formats)
+  let result = normalizeDeveloperRole(messages, targetFormat);
+
+  // Step 2: Normalize system → user (for providers that don't support system role)
+  result = normalizeSystemRole(result, provider, model);
+
+  return result;
+}

open-sse/services/usage.ts

@@ -53,7 +53,7 @@ export async function getUsageForProvider(connection) {
     case "claude":
       return await getClaudeUsage(accessToken);
     case "codex":
-      return await getCodexUsage(accessToken);
+      return await getCodexUsage(accessToken, providerSpecificData);
     case "kiro":
       return await getKiroUsage(accessToken, providerSpecificData);
     case "qwen":
@@ -483,15 +483,26 @@ async function getClaudeUsage(accessToken) {
 
 /**
  * Codex (OpenAI) Usage - Fetch from ChatGPT backend API
+ * IMPORTANT: Uses persisted workspaceId from OAuth to ensure correct workspace binding.
+ * No fallback to other workspaces - strict binding to user's selected workspace.
  */
-async function getCodexUsage(accessToken) {
+async function getCodexUsage(accessToken, providerSpecificData: Record<string, any> = {}) {
   try {
+    // Use persisted workspace ID from OAuth - NO FALLBACK
+    const accountId = providerSpecificData?.workspaceId || null;
+
+    const headers: Record<string, string> = {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+    };
+    if (accountId) {
+      headers["chatgpt-account-id"] = accountId;
+    }
+
     const response = await fetch(CODEX_CONFIG.usageUrl, {
       method: "GET",
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        Accept: "application/json",
-      },
+      headers,
     });
 
     if (!response.ok) {
@@ -500,38 +511,75 @@ async function getCodexUsage(accessToken) {
 
     const data = await response.json();
 
-    // Parse rate limit info
-    const rateLimit = data.rate_limit || {};
-    const primaryWindow = rateLimit.primary_window || {};
-    const secondaryWindow = rateLimit.secondary_window || {};
+    // Helper to get field with snake_case/camelCase fallback
+    const getField = (obj: any, snakeKey: string, camelKey: string) =>
+      obj?.[snakeKey] ?? obj?.[camelKey] ?? null;
 
-    // Parse reset dates (reset_at is Unix timestamp in seconds, multiply by 1000 for ms)
-    const sessionResetAt = parseResetTime(
-      primaryWindow.reset_at ? primaryWindow.reset_at * 1000 : null
-    );
-    const weeklyResetAt = parseResetTime(
-      secondaryWindow.reset_at ? secondaryWindow.reset_at * 1000 : null
+    // Parse rate limit info (supports both snake_case and camelCase)
+    const rateLimit = getField(data, "rate_limit", "rateLimit") || {};
+    const primaryWindow = getField(rateLimit, "primary_window", "primaryWindow") || {};
+    const secondaryWindow = getField(rateLimit, "secondary_window", "secondaryWindow") || {};
+
+    // Parse reset times (reset_at is Unix timestamp in seconds)
+    const parseWindowReset = (window: any) => {
+      const resetAt = getField(window, "reset_at", "resetAt");
+      const resetAfterSeconds = getField(window, "reset_after_seconds", "resetAfterSeconds");
+      if (resetAt) return parseResetTime(resetAt * 1000);
+      if (resetAfterSeconds) return parseResetTime(Date.now() + resetAfterSeconds * 1000);
+      return null;
+    };
+
+    // Build quota windows
+    const quotas: Record<string, any> = {};
+
+    // Primary window (5-hour)
+    if (Object.keys(primaryWindow).length > 0) {
+      quotas.session = {
+        used: getField(primaryWindow, "used_percent", "usedPercent") || 0,
+        total: 100,
+        remaining: 100 - (getField(primaryWindow, "used_percent", "usedPercent") || 0),
+        resetAt: parseWindowReset(primaryWindow),
+        unlimited: false,
+      };
+    }
+
+    // Secondary window (weekly)
+    if (Object.keys(secondaryWindow).length > 0) {
+      quotas.weekly = {
+        used: getField(secondaryWindow, "used_percent", "usedPercent") || 0,
+        total: 100,
+        remaining: 100 - (getField(secondaryWindow, "used_percent", "usedPercent") || 0),
+        resetAt: parseWindowReset(secondaryWindow),
+        unlimited: false,
+      };
+    }
+
+    // Code review rate limit (3rd window — differs per plan: Plus/Pro/Team)
+    const codeReviewRateLimit =
+      getField(data, "code_review_rate_limit", "codeReviewRateLimit") || {};
+    const codeReviewWindow = getField(codeReviewRateLimit, "primary_window", "primaryWindow") || {};
+
+    // Only include code review quota if the API returned data for it
+    const codeReviewUsedPercent = getField(codeReviewWindow, "used_percent", "usedPercent");
+    const codeReviewRemainingCount = getField(
+      codeReviewWindow,
+      "remaining_count",
+      "remainingCount"
     );
+    if (codeReviewUsedPercent !== null || codeReviewRemainingCount !== null) {
+      quotas.code_review = {
+        used: codeReviewUsedPercent || 0,
+        total: 100,
+        remaining: 100 - (codeReviewUsedPercent || 0),
+        resetAt: parseWindowReset(codeReviewWindow),
+        unlimited: false,
+      };
+    }
 
     return {
-      plan: data.plan_type || "unknown",
-      limitReached: rateLimit.limit_reached || false,
-      quotas: {
-        session: {
-          used: primaryWindow.used_percent || 0,
-          total: 100,
-          remaining: 100 - (primaryWindow.used_percent || 0),
-          resetAt: sessionResetAt,
-          unlimited: false,
-        },
-        weekly: {
-          used: secondaryWindow.used_percent || 0,
-          total: 100,
-          remaining: 100 - (secondaryWindow.used_percent || 0),
-          resetAt: weeklyResetAt,
-          unlimited: false,
-        },
-      },
+      plan: getField(data, "plan_type", "planType") || "unknown",
+      limitReached: getField(rateLimit, "limit_reached", "limitReached") || false,
+      quotas,
     };
   } catch (error) {
     throw new Error(`Failed to fetch Codex usage: ${error.message}`);

open-sse/translator/index.ts

@@ -4,6 +4,7 @@ import { prepareClaudeRequest } from "./helpers/claudeHelper.ts";
 import { filterToOpenAIFormat } from "./helpers/openaiHelper.ts";
 import { normalizeThinkingConfig } from "../services/provider.ts";
 import { applyThinkingBudget } from "../services/thinkingBudget.ts";
+import { normalizeRoles } from "../services/roleNormalizer.ts";
 
 // Registry for translators.
 // NOTE: translator modules import this file and call register() at module-load time.
@@ -132,6 +133,11 @@ export function translateRequest(
   // Fix missing tool responses (insert empty tool_result if needed)
   fixMissingToolResponses(result);
 
+  // Normalize roles: developer→system for non-OpenAI, system→user for incompatible models
+  if (result.messages && Array.isArray(result.messages)) {
+    result.messages = normalizeRoles(result.messages, provider || "", model || "", targetFormat);
+  }
+
   // If same format, skip translation steps
   if (sourceFormat !== targetFormat) {
     // Check for direct translation path first (e.g., Claude → Gemini)

open-sse/translator/request/openai-to-gemini.ts

@@ -199,6 +199,24 @@ function openaiToGeminiBase(model, body, stream) {
     }
   }
 
+  // Convert response_format to Gemini's responseMimeType/responseSchema
+  if (body.response_format) {
+    if (body.response_format.type === "json_schema" && body.response_format.json_schema) {
+      result.generationConfig.responseMimeType = "application/json";
+      // Extract the schema (may be nested under .schema key)
+      const schema = body.response_format.json_schema.schema || body.response_format.json_schema;
+      if (schema && typeof schema === "object") {
+        // Remove unsupported keywords for Gemini (it uses a subset of JSON Schema)
+        const { $schema, additionalProperties, ...cleanSchema } = schema;
+        result.generationConfig.responseSchema = cleanSchema;
+      }
+    } else if (body.response_format.type === "json_object") {
+      result.generationConfig.responseMimeType = "application/json";
+    } else if (body.response_format.type === "text") {
+      result.generationConfig.responseMimeType = "text/plain";
+    }
+  }
+
   return result;
 }
 

open-sse/tsconfig.json

@@ -6,6 +6,7 @@
     "allowJs": true,
     "checkJs": true,
     "noEmit": true,
+    "allowImportingTsExtensions": true,
     "skipLibCheck": true,
     "esModuleInterop": true,
     "strict": false,
@@ -18,8 +19,5 @@
       "@omniroute/open-sse/*": ["./open-sse/*"]
     }
   },
-  "include": [
-    "**/*.ts",
-    "**/*.js"
-  ]
+  "include": ["**/*.ts", "**/*.js"]
 }

open-sse/utils/bypassHandler.ts

@@ -1,3 +1,4 @@
+import { getCorsOrigin } from "./cors.ts";
 import { detectFormat } from "../services/provider.ts";
 import { translateResponse, initState } from "../translator/index.ts";
 import { FORMATS } from "../translator/formats.ts";
@@ -122,7 +123,7 @@ function createNonStreamingResponse(sourceFormat, model) {
       response: new Response(JSON.stringify(openaiResponse), {
         headers: {
           "Content-Type": "application/json",
-          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Origin": getCorsOrigin(),
         },
       }),
     };
@@ -156,7 +157,7 @@ function createNonStreamingResponse(sourceFormat, model) {
     response: new Response(JSON.stringify(finalResponse), {
       headers: {
         "Content-Type": "application/json",
-        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Origin": getCorsOrigin(),
       },
     }),
   };
@@ -204,7 +205,7 @@ function createStreamingResponse(sourceFormat, model) {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache",
         Connection: "keep-alive",
-        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Origin": getCorsOrigin(),
       },
     }),
   };

open-sse/utils/cors.ts

@@ -0,0 +1,22 @@
+/**
+ * CORS configuration for open-sse handlers.
+ *
+ * Reads `CORS_ORIGIN` env var (default: "*") so that all handlers
+ * use the same configurable origin. Equivalent to src/shared/utils/cors.ts
+ * for the open-sse package boundary.
+ */
+
+const CORS_ORIGIN = process.env.CORS_ORIGIN || "*";
+
+export const CORS_HEADERS: Record<string, string> = {
+  "Access-Control-Allow-Origin": CORS_ORIGIN,
+  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization, x-api-key, anthropic-version",
+};
+
+/**
+ * Returns just the origin header for merging into existing header objects.
+ */
+export function getCorsOrigin(): string {
+  return CORS_ORIGIN;
+}

open-sse/utils/error.ts

@@ -1,3 +1,4 @@
+import { getCorsOrigin } from "./cors.ts";
 import { ERROR_TYPES, DEFAULT_ERROR_MESSAGES } from "../config/constants.ts";
 
 /**
@@ -33,7 +34,7 @@ export function errorResponse(statusCode, message) {
     status: statusCode,
     headers: {
       "Content-Type": "application/json",
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": getCorsOrigin(),
     },
   });
 }
@@ -131,7 +132,11 @@ export async function parseUpstreamError(response, provider = null) {
  * @param {number|null} retryAfterMs - Optional retry-after time in milliseconds
  * @returns {{ success: false, status: number, error: string, response: Response, retryAfterMs?: number }}
  */
-export function createErrorResult(statusCode: number, message: string, retryAfterMs: number | null = null) {
+export function createErrorResult(
+  statusCode: number,
+  message: string,
+  retryAfterMs: number | null = null
+) {
   const result: Record<string, any> = {
     success: false,
     status: statusCode,

open-sse/utils/ollamaTransform.ts

@@ -1,3 +1,4 @@
+import { getCorsOrigin } from "./cors.ts";
 // Transform OpenAI SSE stream to Ollama JSON lines format
 export function transformToOllama(response, model) {
   let buffer = "";
@@ -85,6 +86,9 @@ export function transformToOllama(response, model) {
   });
 
   return new Response(response.body.pipeThrough(transform), {
-    headers: { "Content-Type": "application/x-ndjson", "Access-Control-Allow-Origin": "*" },
+    headers: {
+      "Content-Type": "application/x-ndjson",
+      "Access-Control-Allow-Origin": getCorsOrigin(),
+    },
   });
 }

open-sse/utils/stream.ts

@@ -12,6 +12,10 @@ import {
 } from "./usageTracking.ts";
 import { parseSSELine, hasValuableContent, fixInvalidId, formatSSE } from "./streamHelpers.ts";
 import { STREAM_IDLE_TIMEOUT_MS, HTTP_STATUS } from "../config/constants.ts";
+import {
+  sanitizeStreamingChunk,
+  extractThinkingFromContent,
+} from "../handlers/responseSanitizer.ts";
 
 export { COLORS, formatSSE };
 
@@ -130,7 +134,10 @@ export function createSSEStream(options: any = {}) {
 
             if (trimmed.startsWith("data:") && trimmed.slice(5).trim() !== "[DONE]") {
               try {
-                const parsed = JSON.parse(trimmed.slice(5).trim());
+                let parsed = JSON.parse(trimmed.slice(5).trim());
+
+                // Sanitize: strip non-standard fields for OpenAI SDK compatibility
+                parsed = sanitizeStreamingChunk(parsed);
 
                 const idFixed = fixInvalidId(parsed);
 
@@ -139,6 +146,16 @@ export function createSSEStream(options: any = {}) {
                 }
 
                 const delta = parsed.choices?.[0]?.delta;
+
+                // Extract <think> tags from streaming content
+                if (delta?.content && typeof delta.content === "string") {
+                  const { content, thinking } = extractThinkingFromContent(delta.content);
+                  delta.content = content;
+                  if (thinking && !delta.reasoning_content) {
+                    delta.reasoning_content = thinking;
+                  }
+                }
+
                 const content = delta?.content || delta?.reasoning_content;
                 if (content && typeof content === "string") {
                   totalContentLength += content.length;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "1.0.1",
+  "version": "1.4.2",
   "description": "Smart AI Router with auto fallback — route to FREE & cheap models, zero downtime. Works with Cursor, Cline, Claude Desktop, Codex, and any OpenAI-compatible tool.",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
     "open-sse"
   ],
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=18.0.0 <24.0.0"
   },
   "keywords": [
     "ai",
@@ -47,13 +47,13 @@
     "build:cli": "node scripts/prepublish.mjs",
     "start": "next start --port 20128",
     "lint": "eslint .",
-    "test": "node --test tests/unit/*.test.mjs",
+    "test": "node --import tsx/esm --test tests/unit/*.test.mjs",
     "test:unit": "node --import tsx/esm --test tests/unit/*.test.mjs",
     "test:plan3": "node --test tests/unit/plan3-p0.test.mjs",
     "test:fixes": "node --test tests/unit/fixes-p1.test.mjs",
     "test:security": "node --test tests/unit/security-fase01.test.mjs",
     "test:e2e": "npx playwright test",
-    "test:coverage": "npx c8 --exclude=open-sse --check-coverage --lines 30 --functions 30 --branches 30 node --import tsx/esm --test tests/unit/*.test.mjs",
+    "test:coverage": "npx c8 --exclude=open-sse --check-coverage --lines 50 --functions 50 --branches 50 node --import tsx/esm --test tests/unit/*.test.mjs",
     "test:all": "npm run test:unit && npm run test:e2e",
     "check": "npm run lint && npm run test",
     "prepublishOnly": "npm run build:cli",
@@ -90,7 +90,7 @@
   "devDependencies": {
     "@playwright/test": "^1.58.2",
     "@tailwindcss/postcss": "^4.1.18",
-    "@types/bcryptjs": "^2.4.6",
+    "@types/bcryptjs": "^3.0.0",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^25.2.3",
     "@types/react": "^19.2.14",
@@ -102,7 +102,8 @@
     "prettier": "^3.8.1",
     "tailwindcss": "^4",
     "tsx": "^4.21.0",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.56.0"
   },
   "lint-staged": {
     "*.{js,jsx,ts,tsx,mjs}": [

src/app/(dashboard)/dashboard/HomePageClient.tsx

@@ -158,10 +158,10 @@ export default function HomePageClient({ machineId }) {
                 <span className="font-semibold">1. Create API key</span>
                 <p className="text-text-muted mt-0.5">
                   Go to{" "}
-                  <Link href="/dashboard/settings" className="text-primary hover:underline">
-                    Settings
+                  <Link href="/dashboard/endpoint" className="text-primary hover:underline">
+                    Endpoint
                   </Link>{" "}
-                  → API Keys. Generate one key per environment.
+                  → Registered Keys. Generate one key per environment.
                 </p>
               </div>
             </li>

src/app/(dashboard)/dashboard/analytics/loading.tsx

@@ -0,0 +1,15 @@
+"use client";
+
+export default function AnalyticsLoading() {
+  return (
+    <div className="space-y-6 animate-pulse p-6">
+      <div className="h-8 bg-gray-200 dark:bg-gray-700 rounded w-40" />
+      <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-4 gap-4">
+        {[1, 2, 3, 4].map((i) => (
+          <div key={i} className="h-24 bg-gray-200 dark:bg-gray-700 rounded-lg" />
+        ))}
+      </div>
+      <div className="h-64 bg-gray-200 dark:bg-gray-700 rounded-lg" />
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/api-manager/page.tsx

@@ -0,0 +1,5 @@
+import ApiManagerPageClient from "./ApiManagerPageClient";
+
+export default function ApiManagerPage() {
+  return <ApiManagerPageClient />;
+}

src/app/(dashboard)/dashboard/audit-log/page.tsx

@@ -0,0 +1,240 @@
+"use client";
+
+/**
+ * Audit Log Viewer — P-2
+ *
+ * Dashboard page for viewing administrative audit log entries.
+ * Fetches from /api/compliance/audit-log with filter support.
+ */
+
+import { useState, useEffect, useCallback } from "react";
+
+interface AuditEntry {
+  id: number;
+  timestamp: string;
+  action: string;
+  actor: string;
+  target: string | null;
+  details: any;
+  ip_address: string | null;
+}
+
+const PAGE_SIZE = 25;
+
+export default function AuditLogPage() {
+  const [entries, setEntries] = useState<AuditEntry[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [actionFilter, setActionFilter] = useState("");
+  const [actorFilter, setActorFilter] = useState("");
+  const [offset, setOffset] = useState(0);
+  const [hasMore, setHasMore] = useState(false);
+
+  const fetchEntries = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+    try {
+      const params = new URLSearchParams();
+      if (actionFilter) params.set("action", actionFilter);
+      if (actorFilter) params.set("actor", actorFilter);
+      params.set("limit", String(PAGE_SIZE + 1));
+      params.set("offset", String(offset));
+
+      const res = await fetch(`/api/compliance/audit-log?${params.toString()}`);
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      const data: AuditEntry[] = await res.json();
+
+      setHasMore(data.length > PAGE_SIZE);
+      setEntries(data.slice(0, PAGE_SIZE));
+    } catch (err: any) {
+      setError(err.message || "Failed to fetch audit log");
+    } finally {
+      setLoading(false);
+    }
+  }, [actionFilter, actorFilter, offset]);
+
+  useEffect(() => {
+    fetchEntries();
+  }, [fetchEntries]);
+
+  const handleSearch = () => {
+    setOffset(0);
+    fetchEntries();
+  };
+
+  const formatTimestamp = (ts: string) => {
+    try {
+      return new Date(ts).toLocaleString();
+    } catch {
+      return ts;
+    }
+  };
+
+  const actionBadgeColor = (action: string) => {
+    if (action.includes("delete") || action.includes("remove"))
+      return "bg-red-500/15 text-red-400 border-red-500/20";
+    if (action.includes("create") || action.includes("add"))
+      return "bg-green-500/15 text-green-400 border-green-500/20";
+    if (action.includes("update") || action.includes("change"))
+      return "bg-blue-500/15 text-blue-400 border-blue-500/20";
+    if (action.includes("login") || action.includes("auth"))
+      return "bg-purple-500/15 text-purple-400 border-purple-500/20";
+    return "bg-gray-500/15 text-gray-400 border-gray-500/20";
+  };
+
+  return (
+    <div className="max-w-6xl mx-auto p-6 space-y-6">
+      {/* Header */}
+      <div className="flex items-center justify-between">
+        <div>
+          <h1 className="text-2xl font-bold text-[var(--color-text-main)]">
+            Audit Log
+          </h1>
+          <p className="text-sm text-[var(--color-text-muted)] mt-1">
+            Administrative actions and security events
+          </p>
+        </div>
+        <button
+          onClick={fetchEntries}
+          disabled={loading}
+          aria-label="Refresh audit log"
+          className="px-4 py-2 rounded-lg text-sm font-medium bg-[var(--color-surface)] border border-[var(--color-border)] text-[var(--color-text-main)] hover:bg-[var(--color-bg-alt)] transition-colors disabled:opacity-50"
+        >
+          {loading ? "Loading..." : "Refresh"}
+        </button>
+      </div>
+
+      {/* Filters */}
+      <div
+        className="flex flex-wrap gap-3 p-4 rounded-xl bg-[var(--color-surface)] border border-[var(--color-border)]"
+        role="search"
+        aria-label="Filter audit log entries"
+      >
+        <input
+          type="text"
+          placeholder="Filter by action..."
+          value={actionFilter}
+          onChange={(e) => setActionFilter(e.target.value)}
+          onKeyDown={(e) => e.key === "Enter" && handleSearch()}
+          aria-label="Filter by action type"
+          className="flex-1 min-w-[180px] px-3 py-2 rounded-lg text-sm bg-[var(--color-bg)] border border-[var(--color-border)] text-[var(--color-text-main)] placeholder:text-[var(--color-text-muted)] focus:outline-2 focus:outline-[var(--color-accent)]"
+        />
+        <input
+          type="text"
+          placeholder="Filter by actor..."
+          value={actorFilter}
+          onChange={(e) => setActorFilter(e.target.value)}
+          onKeyDown={(e) => e.key === "Enter" && handleSearch()}
+          aria-label="Filter by actor"
+          className="flex-1 min-w-[180px] px-3 py-2 rounded-lg text-sm bg-[var(--color-bg)] border border-[var(--color-border)] text-[var(--color-text-main)] placeholder:text-[var(--color-text-muted)] focus:outline-2 focus:outline-[var(--color-accent)]"
+        />
+        <button
+          onClick={handleSearch}
+          className="px-4 py-2 rounded-lg text-sm font-medium bg-[var(--color-accent)] text-white hover:bg-[var(--color-accent-hover)] transition-colors focus:outline-2 focus:outline-offset-2 focus:outline-[var(--color-accent)]"
+        >
+          Search
+        </button>
+      </div>
+
+      {/* Error */}
+      {error && (
+        <div
+          className="p-4 rounded-lg bg-red-500/10 border border-red-500/30 text-red-400 text-sm"
+          role="alert"
+        >
+          {error}
+        </div>
+      )}
+
+      {/* Table */}
+      <div className="overflow-x-auto rounded-xl border border-[var(--color-border)]">
+        <table className="w-full text-sm" role="table" aria-label="Audit log entries">
+          <thead>
+            <tr className="bg-[var(--color-bg-alt)] border-b border-[var(--color-border)]">
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Timestamp
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Action
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Actor
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Target
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Details
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                IP
+              </th>
+            </tr>
+          </thead>
+          <tbody>
+            {entries.length === 0 && !loading ? (
+              <tr>
+                <td colSpan={6} className="px-4 py-8 text-center text-[var(--color-text-muted)]">
+                  No audit log entries found
+                </td>
+              </tr>
+            ) : (
+              entries.map((entry) => (
+                <tr
+                  key={entry.id}
+                  className="border-b border-[var(--color-border)] hover:bg-[var(--color-bg-alt)] transition-colors"
+                >
+                  <td className="px-4 py-3 whitespace-nowrap text-[var(--color-text-muted)] font-mono text-xs">
+                    {formatTimestamp(entry.timestamp)}
+                  </td>
+                  <td className="px-4 py-3">
+                    <span
+                      className={`inline-block px-2 py-0.5 rounded-md text-xs font-medium border ${actionBadgeColor(entry.action)}`}
+                    >
+                      {entry.action}
+                    </span>
+                  </td>
+                  <td className="px-4 py-3 text-[var(--color-text-main)]">
+                    {entry.actor}
+                  </td>
+                  <td className="px-4 py-3 text-[var(--color-text-muted)] max-w-[200px] truncate">
+                    {entry.target || "—"}
+                  </td>
+                  <td className="px-4 py-3 text-[var(--color-text-muted)] max-w-[300px] truncate font-mono text-xs">
+                    {entry.details ? JSON.stringify(entry.details) : "—"}
+                  </td>
+                  <td className="px-4 py-3 text-[var(--color-text-muted)] font-mono text-xs whitespace-nowrap">
+                    {entry.ip_address || "—"}
+                  </td>
+                </tr>
+              ))
+            )}
+          </tbody>
+        </table>
+      </div>
+
+      {/* Pagination */}
+      <div className="flex items-center justify-between">
+        <p className="text-xs text-[var(--color-text-muted)]">
+          Showing {entries.length} entries (offset {offset})
+        </p>
+        <div className="flex gap-2">
+          <button
+            onClick={() => setOffset(Math.max(0, offset - PAGE_SIZE))}
+            disabled={offset === 0}
+            className="px-3 py-1.5 rounded-lg text-xs font-medium bg-[var(--color-surface)] border border-[var(--color-border)] text-[var(--color-text-main)] hover:bg-[var(--color-bg-alt)] disabled:opacity-30 transition-colors"
+          >
+            ← Previous
+          </button>
+          <button
+            onClick={() => setOffset(offset + PAGE_SIZE)}
+            disabled={!hasMore}
+            className="px-3 py-1.5 rounded-lg text-xs font-medium bg-[var(--color-surface)] border border-[var(--color-border)] text-[var(--color-text-main)] hover:bg-[var(--color-bg-alt)] disabled:opacity-30 transition-colors"
+          >
+            Next →
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/combos/page.tsx

@@ -6,6 +6,7 @@ import {
   Button,
   Modal,
   Input,
+  Toggle,
   CardSkeleton,
   ModelSelectModal,
   ProxyConfigModal,
@@ -170,6 +171,25 @@ export default function CombosPage() {
     }
   };
 
+  const handleToggleCombo = async (combo) => {
+    const newActive = combo.isActive === false ? true : false;
+    // Optimistic update
+    setCombos((prev) => prev.map((c) => (c.id === combo.id ? { ...c, isActive: newActive } : c)));
+    try {
+      await fetch(`/api/combos/${combo.id}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ isActive: newActive }),
+      });
+    } catch (error) {
+      // Revert on error
+      setCombos((prev) =>
+        prev.map((c) => (c.id === combo.id ? { ...c, isActive: !newActive } : c))
+      );
+      notify.error("Failed to toggle combo");
+    }
+  };
+
   if (loading) {
     return (
       <div className="flex flex-col gap-6">
@@ -219,6 +239,7 @@ export default function CombosPage() {
               testing={testingCombo === combo.name}
               onProxy={() => setProxyTargetCombo(combo)}
               hasProxy={!!proxyConfig?.combos?.[combo.id]}
+              onToggle={() => handleToggleCombo(combo)}
             />
           ))}
         </div>
@@ -287,12 +308,14 @@ function ComboCard({
   testing,
   onProxy,
   hasProxy,
+  onToggle,
 }) {
   const strategy = combo.strategy || "priority";
   const models = combo.models || [];
+  const isDisabled = combo.isActive === false;
 
   return (
-    <Card padding="sm" className="group">
+    <Card padding="sm" className={`group ${isDisabled ? "opacity-50" : ""}`}>
       <div className="flex items-center justify-between">
         <div className="flex items-center gap-3 flex-1 min-w-0">
           {/* Icon */}
@@ -386,47 +409,55 @@ function ComboCard({
         </div>
 
         {/* Actions */}
-        <div className="flex gap-0.5 opacity-0 group-hover:opacity-100 transition-opacity shrink-0">
-          <button
-            onClick={onTest}
-            disabled={testing}
-            className="p-1.5 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-emerald-500 transition-colors"
-            title="Test combo"
-          >
-            <span
-              className={`material-symbols-outlined text-[16px] ${testing ? "animate-spin" : ""}`}
+        <div className="flex items-center gap-1.5 shrink-0 ml-2">
+          <Toggle
+            size="sm"
+            checked={!isDisabled}
+            onChange={onToggle}
+            title={isDisabled ? "Enable combo" : "Disable combo"}
+          />
+          <div className="flex items-center gap-1 opacity-0 group-hover:opacity-100 transition-opacity">
+            <button
+              onClick={onTest}
+              disabled={testing}
+              className="p-1.5 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-emerald-500 transition-colors"
+              title="Test combo"
             >
-              {testing ? "progress_activity" : "play_arrow"}
-            </span>
-          </button>
-          <button
-            onClick={onDuplicate}
-            className="p-1.5 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-primary transition-colors"
-            title="Duplicate"
-          >
-            <span className="material-symbols-outlined text-[16px]">content_copy</span>
-          </button>
-          <button
-            onClick={onProxy}
-            className="p-1.5 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-primary transition-colors"
-            title="Proxy configuration"
-          >
-            <span className="material-symbols-outlined text-[16px]">vpn_lock</span>
-          </button>
-          <button
-            onClick={onEdit}
-            className="p-1.5 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-primary transition-colors"
-            title="Edit"
-          >
-            <span className="material-symbols-outlined text-[16px]">edit</span>
-          </button>
-          <button
-            onClick={onDelete}
-            className="p-1.5 hover:bg-red-500/10 rounded text-red-500 transition-colors"
-            title="Delete"
-          >
-            <span className="material-symbols-outlined text-[16px]">delete</span>
-          </button>
+              <span
+                className={`material-symbols-outlined text-[16px] ${testing ? "animate-spin" : ""}`}
+              >
+                {testing ? "progress_activity" : "play_arrow"}
+              </span>
+            </button>
+            <button
+              onClick={onDuplicate}
+              className="p-1.5 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-primary transition-colors"
+              title="Duplicate"
+            >
+              <span className="material-symbols-outlined text-[16px]">content_copy</span>
+            </button>
+            <button
+              onClick={onProxy}
+              className="p-1.5 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-primary transition-colors"
+              title="Proxy configuration"
+            >
+              <span className="material-symbols-outlined text-[16px]">vpn_lock</span>
+            </button>
+            <button
+              onClick={onEdit}
+              className="p-1.5 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-primary transition-colors"
+              title="Edit"
+            >
+              <span className="material-symbols-outlined text-[16px]">edit</span>
+            </button>
+            <button
+              onClick={onDelete}
+              className="p-1.5 hover:bg-red-500/10 rounded text-red-500 transition-colors"
+              title="Delete"
+            >
+              <span className="material-symbols-outlined text-[16px]">delete</span>
+            </button>
+          </div>
         </div>
       </div>
     </Card>

src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx

@@ -1,8 +1,7 @@
 "use client";
 
-import { useState, useEffect, useMemo, useCallback } from "react";
+import { useState, useEffect, useMemo } from "react";
 import PropTypes from "prop-types";
-import Image from "next/image";
 import { Card, Button, Input, Modal, CardSkeleton } from "@/shared/components";
 import { useCopyToClipboard } from "@/shared/hooks/useCopyToClipboard";
 import { AI_PROVIDERS, getProviderByAlias } from "@/shared/constants/providers";
@@ -11,12 +10,8 @@ const CLOUD_URL = process.env.NEXT_PUBLIC_CLOUD_URL;
 const CLOUD_ACTION_TIMEOUT_MS = 15000;
 
 export default function APIPageClient({ machineId }) {
-  const [keys, setKeys] = useState([]);
   const [providerConnections, setProviderConnections] = useState([]);
   const [loading, setLoading] = useState(true);
-  const [showAddModal, setShowAddModal] = useState(false);
-  const [newKeyName, setNewKeyName] = useState("");
-  const [createdKey, setCreatedKey] = useState(null);
 
   // Endpoints / models state
   const [allModels, setAllModels] = useState([]);
@@ -53,16 +48,19 @@ export default function APIPageClient({ machineId }) {
   };
 
   // Categorize models by endpoint type
+  // Filter out parent models (models with parent field set) to avoid showing duplicates
   const endpointData = useMemo(() => {
-    const chat = allModels.filter((m) => !m.type);
-    const embeddings = allModels.filter((m) => m.type === "embedding");
-    const images = allModels.filter((m) => m.type === "image");
-    const rerank = allModels.filter((m) => m.type === "rerank");
+    const chat = allModels.filter((m) => !m.type && !m.parent);
+    const embeddings = allModels.filter((m) => m.type === "embedding" && !m.parent);
+    const images = allModels.filter((m) => m.type === "image" && !m.parent);
+    const rerank = allModels.filter((m) => m.type === "rerank" && !m.parent);
     const audioTranscription = allModels.filter(
-      (m) => m.type === "audio" && m.subtype === "transcription"
+      (m) => m.type === "audio" && m.subtype === "transcription" && !m.parent
     );
-    const audioSpeech = allModels.filter((m) => m.type === "audio" && m.subtype === "speech");
-    const moderation = allModels.filter((m) => m.type === "moderation");
+    const audioSpeech = allModels.filter(
+      (m) => m.type === "audio" && m.subtype === "speech" && !m.parent
+    );
+    const moderation = allModels.filter((m) => m.type === "moderation" && !m.parent);
     return { chat, embeddings, images, rerank, audioTranscription, audioSpeech, moderation };
   }, [allModels]);
 
@@ -130,16 +128,9 @@ export default function APIPageClient({ machineId }) {
 
   const fetchData = async () => {
     try {
-      const [keysRes, providersRes] = await Promise.all([
-        fetch("/api/keys"),
-        fetch("/api/providers"),
-      ]);
+      const providersRes = await fetch("/api/providers");
 
-      const [keysData, providersData] = await Promise.all([keysRes.json(), providersRes.json()]);
-
-      if (keysRes.ok) {
-        setKeys(keysData.keys || []);
-      }
+      const providersData = await providersRes.json();
 
       if (providersRes.ok) {
         setProviderConnections(providersData.connections || []);
@@ -280,41 +271,6 @@ export default function APIPageClient({ machineId }) {
     }
   };
 
-  const handleCreateKey = async () => {
-    if (!newKeyName.trim()) return;
-
-    try {
-      const res = await fetch("/api/keys", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ name: newKeyName }),
-      });
-      const data = await res.json();
-
-      if (res.ok) {
-        setCreatedKey(data.key);
-        await fetchData();
-        setNewKeyName("");
-        setShowAddModal(false);
-      }
-    } catch (error) {
-      console.log("Error creating key:", error);
-    }
-  };
-
-  const handleDeleteKey = async (id) => {
-    if (!confirm("Delete this API key?")) return;
-
-    try {
-      const res = await fetch(`/api/keys/${id}`, { method: "DELETE" });
-      if (res.ok) {
-        setKeys(keys.filter((k) => k.id !== id));
-      }
-    } catch (error) {
-      console.log("Error deleting key:", error);
-    }
-  };
-
   const [baseUrl, setBaseUrl] = useState("/v1");
   const cloudEndpointNew = `${CLOUD_URL}/v1`;
 
@@ -438,95 +394,6 @@ export default function APIPageClient({ machineId }) {
             {copied === "endpoint_url" ? "Copied!" : "Copy"}
           </Button>
         </div>
-
-        {/* Registered Keys — collapsible section inside API Endpoint card */}
-        <div className="border border-border rounded-lg overflow-hidden mt-4">
-          <button
-            onClick={() => setExpandedEndpoint(expandedEndpoint === "keys" ? null : "keys")}
-            className="w-full flex items-center gap-3 p-4 hover:bg-surface/50 transition-colors text-left"
-          >
-            <div className="flex items-center justify-center size-10 rounded-lg bg-amber-500/10 shrink-0">
-              <span className="material-symbols-outlined text-xl text-amber-500">vpn_key</span>
-            </div>
-            <div className="flex-1 min-w-0">
-              <div className="flex items-center gap-2">
-                <span className="font-semibold text-sm">Registered Keys</span>
-                <span className="text-xs px-2 py-0.5 rounded-full bg-surface text-text-muted font-medium">
-                  {keys.length} {keys.length === 1 ? "key" : "keys"}
-                </span>
-              </div>
-              <p className="text-xs text-text-muted mt-0.5">
-                Manage API keys used to authenticate requests to this endpoint
-              </p>
-            </div>
-            <span
-              className={`material-symbols-outlined text-text-muted text-lg transition-transform ${expandedEndpoint === "keys" ? "rotate-180" : ""}`}
-            >
-              expand_more
-            </span>
-          </button>
-
-          {expandedEndpoint === "keys" && (
-            <div className="border-t border-border px-4 pb-4">
-              <div className="flex items-center justify-between mt-3 mb-3">
-                <p className="text-xs text-text-muted">
-                  Each key isolates usage tracking and can be revoked independently.
-                </p>
-                <Button size="sm" icon="add" onClick={() => setShowAddModal(true)}>
-                  Create Key
-                </Button>
-              </div>
-
-              {keys.length === 0 ? (
-                <div className="text-center py-8">
-                  <div className="inline-flex items-center justify-center w-12 h-12 rounded-full bg-primary/10 text-primary mb-3">
-                    <span className="material-symbols-outlined text-[24px]">vpn_key</span>
-                  </div>
-                  <p className="text-text-main font-medium mb-1 text-sm">No API keys yet</p>
-                  <p className="text-xs text-text-muted mb-3">
-                    Create your first API key to get started
-                  </p>
-                  <Button size="sm" icon="add" onClick={() => setShowAddModal(true)}>
-                    Create Key
-                  </Button>
-                </div>
-              ) : (
-                <div className="flex flex-col">
-                  {keys.map((key) => (
-                    <div
-                      key={key.id}
-                      className="group flex items-center justify-between py-3 border-b border-black/[0.03] dark:border-white/[0.03] last:border-b-0"
-                    >
-                      <div className="flex-1 min-w-0">
-                        <p className="text-sm font-medium">{key.name}</p>
-                        <div className="flex items-center gap-2 mt-1">
-                          <code className="text-xs text-text-muted font-mono">{key.key}</code>
-                          <button
-                            onClick={() => copy(key.key, key.id)}
-                            className="p-1 hover:bg-black/5 dark:hover:bg-white/5 rounded text-text-muted hover:text-primary opacity-0 group-hover:opacity-100 transition-all"
-                          >
-                            <span className="material-symbols-outlined text-[14px]">
-                              {copied === key.id ? "check" : "content_copy"}
-                            </span>
-                          </button>
-                        </div>
-                        <p className="text-xs text-text-muted mt-1">
-                          Created {new Date(key.createdAt).toLocaleDateString()}
-                        </p>
-                      </div>
-                      <button
-                        onClick={() => handleDeleteKey(key.id)}
-                        className="p-2 hover:bg-red-500/10 rounded text-red-500 opacity-0 group-hover:opacity-100 transition-all"
-                      >
-                        <span className="material-symbols-outlined text-[18px]">delete</span>
-                      </button>
-                    </div>
-                  ))}
-                </div>
-              )}
-            </div>
-          )}
-        </div>
       </Card>
 
       {/* Available Endpoints */}
@@ -535,7 +402,8 @@ export default function APIPageClient({ machineId }) {
           <div>
             <h2 className="text-lg font-semibold">Available Endpoints</h2>
             <p className="text-sm text-text-muted">
-              {allModels.length} models across{" "}
+              {Object.values(endpointData).reduce((acc, models) => acc + models.length, 0)} models
+              across{" "}
               {
                 [
                   endpointData.chat,
@@ -833,67 +701,6 @@ export default function APIPageClient({ machineId }) {
         </div>
       </Modal>
 
-      {/* Add Key Modal */}
-      <Modal
-        isOpen={showAddModal}
-        title="Create API Key"
-        onClose={() => {
-          setShowAddModal(false);
-          setNewKeyName("");
-        }}
-      >
-        <div className="flex flex-col gap-4">
-          <Input
-            label="Key Name"
-            value={newKeyName}
-            onChange={(e) => setNewKeyName(e.target.value)}
-            placeholder="Production Key"
-          />
-          <div className="flex gap-2">
-            <Button onClick={handleCreateKey} fullWidth disabled={!newKeyName.trim()}>
-              Create
-            </Button>
-            <Button
-              onClick={() => {
-                setShowAddModal(false);
-                setNewKeyName("");
-              }}
-              variant="ghost"
-              fullWidth
-            >
-              Cancel
-            </Button>
-          </div>
-        </div>
-      </Modal>
-
-      {/* Created Key Modal */}
-      <Modal isOpen={!!createdKey} title="API Key Created" onClose={() => setCreatedKey(null)}>
-        <div className="flex flex-col gap-4">
-          <div className="bg-yellow-50 dark:bg-yellow-900/20 border border-yellow-200 dark:border-yellow-800 rounded-lg p-4">
-            <p className="text-sm text-yellow-800 dark:text-yellow-200 mb-2 font-medium">
-              Save this key now!
-            </p>
-            <p className="text-sm text-yellow-700 dark:text-yellow-300">
-              This is the only time you will see this key. Store it securely.
-            </p>
-          </div>
-          <div className="flex gap-2">
-            <Input value={createdKey || ""} readOnly className="flex-1 font-mono text-sm" />
-            <Button
-              variant="secondary"
-              icon={copied === "created_key" ? "check" : "content_copy"}
-              onClick={() => copy(createdKey, "created_key")}
-            >
-              {copied === "created_key" ? "Copied!" : "Copy"}
-            </Button>
-          </div>
-          <Button onClick={() => setCreatedKey(null)} fullWidth>
-            Done
-          </Button>
-        </div>
-      </Modal>
-
       {/* Disable Cloud Modal */}
       <Modal
         isOpen={showDisableModal}
@@ -979,83 +786,16 @@ APIPageClient.propTypes = {
   machineId: PropTypes.string.isRequired,
 };
 
-function ProviderOverviewCard({ item, onClick }) {
-  const [imgError, setImgError] = useState(false);
-
-  const statusVariant =
-    item.errors > 0 ? "text-red-500" : item.connected > 0 ? "text-green-500" : "text-text-muted";
-
-  return (
-    <div
-      className="border border-border rounded-lg p-3 hover:bg-surface/40 transition-colors cursor-pointer"
-      onClick={onClick}
-      role="button"
-      tabIndex={0}
-      onKeyDown={(e) => e.key === "Enter" && onClick?.()}
-    >
-      <div className="flex items-center gap-2.5">
-        <div
-          className="size-8 rounded-lg flex items-center justify-center"
-          style={{ backgroundColor: `${item.provider.color || "#888"}15` }}
-        >
-          {imgError ? (
-            <span
-              className="text-[10px] font-bold"
-              style={{ color: item.provider.color || "#888" }}
-            >
-              {item.provider.textIcon || item.provider.id.slice(0, 2).toUpperCase()}
-            </span>
-          ) : (
-            <Image
-              src={`/providers/${item.provider.id}.png`}
-              alt={item.provider.name}
-              width={26}
-              height={26}
-              className="object-contain rounded-lg"
-              sizes="26px"
-              onError={() => setImgError(true)}
-            />
-          )}
-        </div>
-
-        <div className="min-w-0 flex-1">
-          <p className="text-sm font-semibold truncate">{item.provider.name}</p>
-          <p className={`text-xs ${statusVariant}`}>
-            {item.total === 0
-              ? "Not configured"
-              : `${item.connected} active · ${item.errors} error`}
-          </p>
-        </div>
-
-        <span className="text-xs text-text-muted">#{item.total}</span>
-      </div>
-    </div>
-  );
-}
-
-ProviderOverviewCard.propTypes = {
-  item: PropTypes.shape({
-    id: PropTypes.string.isRequired,
-    provider: PropTypes.shape({
-      id: PropTypes.string.isRequired,
-      name: PropTypes.string.isRequired,
-      color: PropTypes.string,
-      textIcon: PropTypes.string,
-    }).isRequired,
-    total: PropTypes.number.isRequired,
-    connected: PropTypes.number.isRequired,
-    errors: PropTypes.number.isRequired,
-  }).isRequired,
-  onClick: PropTypes.func,
-};
-
 // -- Sub-component: Provider Models Modal ------------------------------------------
 
 function ProviderModelsModal({ provider, models, copy, copied, onClose }) {
   // Get provider alias for matching models
+  // Filter out parent models (models with parent field set) to avoid showing duplicates
   const providerAlias = provider.provider.alias || provider.id;
   const providerModels = useMemo(() => {
-    return models.filter((m) => m.owned_by === providerAlias || m.owned_by === provider.id);
+    return models.filter(
+      (m) => !m.parent && (m.owned_by === providerAlias || m.owned_by === provider.id)
+    );
   }, [models, providerAlias, provider.id]);
 
   const chatModels = providerModels.filter((m) => !m.type);
@@ -1151,7 +891,9 @@ function EndpointSection({
       if (!map[owner]) map[owner] = [];
       map[owner].push(m);
     }
-    return Object.entries(map).sort((a: any, b: any) => (b[1] as any).length - (a[1] as any).length);
+    return Object.entries(map).sort(
+      (a: any, b: any) => (b[1] as any).length - (a[1] as any).length
+    );
   }, [models]);
 
   const resolveProvider = (id) => AI_PROVIDERS[id] || getProviderByAlias(id);
@@ -1216,7 +958,9 @@ function EndpointSection({
                   <span className="text-xs font-semibold text-text-main">
                     {providerName(providerId)}
                   </span>
-                  <span className="text-xs text-text-muted">({(providerModels as any).length})</span>
+                  <span className="text-xs text-text-muted">
+                    ({(providerModels as any).length})
+                  </span>
                 </div>
                 <div className="ml-5 flex flex-wrap gap-1.5">
                   {(providerModels as any).map((m) => (

src/app/(dashboard)/dashboard/logs/AuditLogTab.tsx

@@ -0,0 +1,232 @@
+"use client";
+
+/**
+ * Audit Log Tab — Embedded version of the audit-log page for the Logs dashboard.
+ * Fetches from /api/compliance/audit-log with filter support.
+ */
+
+import { useState, useEffect, useCallback } from "react";
+
+interface AuditEntry {
+  id: number;
+  timestamp: string;
+  action: string;
+  actor: string;
+  target: string | null;
+  details: any;
+  ip_address: string | null;
+}
+
+const PAGE_SIZE = 25;
+
+export default function AuditLogTab() {
+  const [entries, setEntries] = useState<AuditEntry[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [actionFilter, setActionFilter] = useState("");
+  const [actorFilter, setActorFilter] = useState("");
+  const [offset, setOffset] = useState(0);
+  const [hasMore, setHasMore] = useState(false);
+
+  const fetchEntries = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+    try {
+      const params = new URLSearchParams();
+      if (actionFilter) params.set("action", actionFilter);
+      if (actorFilter) params.set("actor", actorFilter);
+      params.set("limit", String(PAGE_SIZE + 1));
+      params.set("offset", String(offset));
+
+      const res = await fetch(`/api/compliance/audit-log?${params.toString()}`);
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      const data: AuditEntry[] = await res.json();
+
+      setHasMore(data.length > PAGE_SIZE);
+      setEntries(data.slice(0, PAGE_SIZE));
+    } catch (err: any) {
+      setError(err.message || "Failed to fetch audit log");
+    } finally {
+      setLoading(false);
+    }
+  }, [actionFilter, actorFilter, offset]);
+
+  useEffect(() => {
+    fetchEntries();
+  }, [fetchEntries]);
+
+  const handleSearch = () => {
+    setOffset(0);
+    fetchEntries();
+  };
+
+  const formatTimestamp = (ts: string) => {
+    try {
+      return new Date(ts).toLocaleString();
+    } catch {
+      return ts;
+    }
+  };
+
+  const actionBadgeColor = (action: string) => {
+    if (action.includes("delete") || action.includes("remove"))
+      return "bg-red-500/15 text-red-400 border-red-500/20";
+    if (action.includes("create") || action.includes("add"))
+      return "bg-green-500/15 text-green-400 border-green-500/20";
+    if (action.includes("update") || action.includes("change"))
+      return "bg-blue-500/15 text-blue-400 border-blue-500/20";
+    if (action.includes("login") || action.includes("auth"))
+      return "bg-purple-500/15 text-purple-400 border-purple-500/20";
+    return "bg-gray-500/15 text-gray-400 border-gray-500/20";
+  };
+
+  return (
+    <div className="space-y-6">
+      {/* Header */}
+      <div className="flex items-center justify-between">
+        <div>
+          <h2 className="text-xl font-bold text-[var(--color-text-main)]">Audit Log</h2>
+          <p className="text-sm text-[var(--color-text-muted)] mt-1">
+            Administrative actions and security events
+          </p>
+        </div>
+        <button
+          onClick={fetchEntries}
+          disabled={loading}
+          aria-label="Refresh audit log"
+          className="px-4 py-2 rounded-lg text-sm font-medium bg-[var(--color-surface)] border border-[var(--color-border)] text-[var(--color-text-main)] hover:bg-[var(--color-bg-alt)] transition-colors disabled:opacity-50"
+        >
+          {loading ? "Loading..." : "Refresh"}
+        </button>
+      </div>
+
+      {/* Filters */}
+      <div
+        className="flex flex-wrap gap-3 p-4 rounded-xl bg-[var(--color-surface)] border border-[var(--color-border)]"
+        role="search"
+        aria-label="Filter audit log entries"
+      >
+        <input
+          type="text"
+          placeholder="Filter by action..."
+          value={actionFilter}
+          onChange={(e) => setActionFilter(e.target.value)}
+          onKeyDown={(e) => e.key === "Enter" && handleSearch()}
+          aria-label="Filter by action type"
+          className="flex-1 min-w-[180px] px-3 py-2 rounded-lg text-sm bg-[var(--color-bg)] border border-[var(--color-border)] text-[var(--color-text-main)] placeholder:text-[var(--color-text-muted)] focus:outline-2 focus:outline-[var(--color-accent)]"
+        />
+        <input
+          type="text"
+          placeholder="Filter by actor..."
+          value={actorFilter}
+          onChange={(e) => setActorFilter(e.target.value)}
+          onKeyDown={(e) => e.key === "Enter" && handleSearch()}
+          aria-label="Filter by actor"
+          className="flex-1 min-w-[180px] px-3 py-2 rounded-lg text-sm bg-[var(--color-bg)] border border-[var(--color-border)] text-[var(--color-text-main)] placeholder:text-[var(--color-text-muted)] focus:outline-2 focus:outline-[var(--color-accent)]"
+        />
+        <button
+          onClick={handleSearch}
+          className="px-4 py-2 rounded-lg text-sm font-medium bg-[var(--color-accent)] text-white hover:bg-[var(--color-accent-hover)] transition-colors focus:outline-2 focus:outline-offset-2 focus:outline-[var(--color-accent)]"
+        >
+          Search
+        </button>
+      </div>
+
+      {/* Error */}
+      {error && (
+        <div
+          className="p-4 rounded-lg bg-red-500/10 border border-red-500/30 text-red-400 text-sm"
+          role="alert"
+        >
+          {error}
+        </div>
+      )}
+
+      {/* Table */}
+      <div className="overflow-x-auto rounded-xl border border-[var(--color-border)]">
+        <table className="w-full text-sm" role="table" aria-label="Audit log entries">
+          <thead>
+            <tr className="bg-[var(--color-bg-alt)] border-b border-[var(--color-border)]">
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Timestamp
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Action
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Actor
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Target
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">
+                Details
+              </th>
+              <th className="text-left px-4 py-3 font-medium text-[var(--color-text-muted)]">IP</th>
+            </tr>
+          </thead>
+          <tbody>
+            {entries.length === 0 && !loading ? (
+              <tr>
+                <td colSpan={6} className="px-4 py-8 text-center text-[var(--color-text-muted)]">
+                  No audit log entries found
+                </td>
+              </tr>
+            ) : (
+              entries.map((entry) => (
+                <tr
+                  key={entry.id}
+                  className="border-b border-[var(--color-border)] hover:bg-[var(--color-bg-alt)] transition-colors"
+                >
+                  <td className="px-4 py-3 whitespace-nowrap text-[var(--color-text-muted)] font-mono text-xs">
+                    {formatTimestamp(entry.timestamp)}
+                  </td>
+                  <td className="px-4 py-3">
+                    <span
+                      className={`inline-block px-2 py-0.5 rounded-md text-xs font-medium border ${actionBadgeColor(entry.action)}`}
+                    >
+                      {entry.action}
+                    </span>
+                  </td>
+                  <td className="px-4 py-3 text-[var(--color-text-main)]">{entry.actor}</td>
+                  <td className="px-4 py-3 text-[var(--color-text-muted)] max-w-[200px] truncate">
+                    {entry.target || "—"}
+                  </td>
+                  <td className="px-4 py-3 text-[var(--color-text-muted)] max-w-[300px] truncate font-mono text-xs">
+                    {entry.details ? JSON.stringify(entry.details) : "—"}
+                  </td>
+                  <td className="px-4 py-3 text-[var(--color-text-muted)] font-mono text-xs whitespace-nowrap">
+                    {entry.ip_address || "—"}
+                  </td>
+                </tr>
+              ))
+            )}
+          </tbody>
+        </table>
+      </div>
+
+      {/* Pagination */}
+      <div className="flex items-center justify-between">
+        <p className="text-xs text-[var(--color-text-muted)]">
+          Showing {entries.length} entries (offset {offset})
+        </p>
+        <div className="flex gap-2">
+          <button
+            onClick={() => setOffset(Math.max(0, offset - PAGE_SIZE))}
+            disabled={offset === 0}
+            className="px-3 py-1.5 rounded-lg text-xs font-medium bg-[var(--color-surface)] border border-[var(--color-border)] text-[var(--color-text-main)] hover:bg-[var(--color-bg-alt)] disabled:opacity-30 transition-colors"
+          >
+            ← Previous
+          </button>
+          <button
+            onClick={() => setOffset(offset + PAGE_SIZE)}
+            disabled={!hasMore}
+            className="px-3 py-1.5 rounded-lg text-xs font-medium bg-[var(--color-surface)] border border-[var(--color-border)] text-[var(--color-text-main)] hover:bg-[var(--color-bg-alt)] disabled:opacity-30 transition-colors"
+          >
+            Next →
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/logs/page.tsx

@@ -0,0 +1,31 @@
+"use client";
+
+import { useState } from "react";
+import { RequestLoggerV2, ProxyLogger, SegmentedControl } from "@/shared/components";
+import ConsoleLogViewer from "@/shared/components/ConsoleLogViewer";
+import AuditLogTab from "./AuditLogTab";
+
+export default function LogsPage() {
+  const [activeTab, setActiveTab] = useState("request-logs");
+
+  return (
+    <div className="flex flex-col gap-6">
+      <SegmentedControl
+        options={[
+          { value: "request-logs", label: "Request Logs" },
+          { value: "proxy-logs", label: "Proxy Logs" },
+          { value: "audit-logs", label: "Audit Logs" },
+          { value: "console", label: "Console" },
+        ]}
+        value={activeTab}
+        onChange={setActiveTab}
+      />
+
+      {/* Content */}
+      {activeTab === "request-logs" && <RequestLoggerV2 />}
+      {activeTab === "proxy-logs" && <ProxyLogger />}
+      {activeTab === "audit-logs" && <AuditLogTab />}
+      {activeTab === "console" && <ConsoleLogViewer />}
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/onboarding/page.tsx

@@ -71,27 +71,35 @@ export default function OnboardingWizard() {
     if (step > 0) setStep(step - 1);
   };
 
+  const [errorMessage, setErrorMessage] = useState("");
+
   const handleSetPassword = async () => {
     if (skipSecurity) {
       handleNext();
       return;
     }
     if (password !== confirmPassword) return;
+    setErrorMessage("");
     try {
-      await fetch("/api/settings/require-login", {
+      const res = await fetch("/api/settings/require-login", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ requireLogin: true, password }),
       });
+      if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        setErrorMessage(data.error || "Failed to set password. Try again.");
+        return;
+      }
       handleNext();
     } catch {
-      // Fallback: skip
-      handleNext();
+      setErrorMessage("Connection error. Please try again.");
     }
   };
 
   const handleAddProvider = async () => {
     if (!selectedProvider || !providerKey) return;
+    setErrorMessage("");
     try {
       const provider = COMMON_PROVIDERS.find((p) => p.id === selectedProvider);
       const defaultUrls = {
@@ -102,7 +110,7 @@ export default function OnboardingWizard() {
         groq: "https://api.groq.com/openai",
         mistral: "https://api.mistral.ai",
       };
-      await fetch("/api/providers", {
+      const res = await fetch("/api/providers", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
@@ -113,9 +121,14 @@ export default function OnboardingWizard() {
           isActive: true,
         }),
       });
+      if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        setErrorMessage(data.error || "Failed to add provider. Try again.");
+        return;
+      }
       handleNext();
     } catch {
-      handleNext();
+      setErrorMessage("Connection error. Please try again.");
     }
   };
 

src/app/(dashboard)/dashboard/providers/error.tsx

@@ -0,0 +1,28 @@
+"use client";
+
+export default function ProvidersError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  return (
+    <div className="flex flex-col items-center justify-center min-h-[400px] p-6">
+      <div className="text-center space-y-4">
+        <h2 className="text-xl font-semibold text-red-600 dark:text-red-400">
+          Failed to load providers
+        </h2>
+        <p className="text-gray-600 dark:text-gray-400 max-w-md">
+          {error.message || "An unexpected error occurred while loading provider data."}
+        </p>
+        <button
+          onClick={reset}
+          className="px-4 py-2 bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
+        >
+          Try Again
+        </button>
+      </div>
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/providers/loading.tsx

@@ -0,0 +1,14 @@
+"use client";
+
+export default function ProvidersLoading() {
+  return (
+    <div className="space-y-6 animate-pulse p-6">
+      <div className="h-8 bg-gray-200 dark:bg-gray-700 rounded w-48" />
+      <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
+        {[1, 2, 3].map((i) => (
+          <div key={i} className="h-40 bg-gray-200 dark:bg-gray-700 rounded-lg" />
+        ))}
+      </div>
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/providers/page.tsx

@@ -3,7 +3,16 @@
 import { useState, useEffect } from "react";
 import Image from "next/image";
 import PropTypes from "prop-types";
-import { Card, CardSkeleton, Badge, Button, Input, Modal, Select } from "@/shared/components";
+import {
+  Card,
+  CardSkeleton,
+  Badge,
+  Button,
+  Input,
+  Modal,
+  Select,
+  Toggle,
+} from "@/shared/components";
 import { OAUTH_PROVIDERS, APIKEY_PROVIDERS } from "@/shared/constants/config";
 import {
   FREE_PROVIDERS,
@@ -134,14 +143,41 @@ export default function ProvidersPage() {
     const error = errorConns.length;
     const total = providerConnections.length;
 
+    // Check if all connections are manually disabled
+    const allDisabled = total > 0 && providerConnections.every((c) => c.isActive === false);
+
     // Get latest error info
     const latestError = errorConns.sort(
-      (a: any, b: any) => (new Date(b.lastErrorAt || 0) as any) - (new Date(a.lastErrorAt || 0) as any)
+      (a: any, b: any) =>
+        (new Date(b.lastErrorAt || 0) as any) - (new Date(a.lastErrorAt || 0) as any)
     )[0];
     const errorCode = latestError ? getConnectionErrorTag(latestError) : null;
     const errorTime = latestError?.lastErrorAt ? getRelativeTime(latestError.lastErrorAt) : null;
 
-    return { connected, error, total, errorCode, errorTime };
+    return { connected, error, total, errorCode, errorTime, allDisabled };
+  };
+
+  // Toggle all connections for a provider on/off
+  const handleToggleProvider = async (providerId: string, authType: string, newActive: boolean) => {
+    const providerConns = connections.filter(
+      (c) => c.provider === providerId && c.authType === authType
+    );
+    // Optimistically update UI
+    setConnections((prev) =>
+      prev.map((c) =>
+        c.provider === providerId && c.authType === authType ? { ...c, isActive: newActive } : c
+      )
+    );
+    // Fire API calls in parallel
+    await Promise.allSettled(
+      providerConns.map((c) =>
+        fetch(`/api/providers/${c.id}`, {
+          method: "PUT",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ isActive: newActive }),
+        })
+      )
+    );
   };
 
   const handleBatchTest = async (mode, providerId = null) => {
@@ -233,6 +269,7 @@ export default function ProvidersPage() {
               provider={info}
               stats={getProviderStats(key, "oauth")}
               authType="oauth"
+              onToggle={(active) => handleToggleProvider(key, "oauth", active)}
             />
           ))}
         </div>
@@ -269,6 +306,7 @@ export default function ProvidersPage() {
               provider={info}
               stats={getProviderStats(key, "oauth")}
               authType="free"
+              onToggle={(active) => handleToggleProvider(key, "oauth", active)}
             />
           ))}
         </div>
@@ -306,6 +344,7 @@ export default function ProvidersPage() {
               provider={info}
               stats={getProviderStats(key, "apikey")}
               authType="apikey"
+              onToggle={(active) => handleToggleProvider(key, "apikey", active)}
             />
           ))}
         </div>
@@ -369,6 +408,7 @@ export default function ProvidersPage() {
                 provider={info}
                 stats={getProviderStats(info.id, "apikey")}
                 authType="compatible"
+                onToggle={(active) => handleToggleProvider(info.id, "apikey", active)}
               />
             ))}
           </div>
@@ -421,8 +461,8 @@ export default function ProvidersPage() {
   );
 }
 
-function ProviderCard({ providerId, provider, stats, authType }) {
-  const { connected, error, errorCode, errorTime } = stats;
+function ProviderCard({ providerId, provider, stats, authType, onToggle }) {
+  const { connected, error, errorCode, errorTime, allDisabled } = stats;
   const [imgError, setImgError] = useState(false);
 
   const dotColors = {
@@ -437,7 +477,7 @@ function ProviderCard({ providerId, provider, stats, authType }) {
     <Link href={`/dashboard/providers/${providerId}`} className="group">
       <Card
         padding="xs"
-        className="h-full hover:bg-black/[0.01] dark:hover:bg-white/[0.01] transition-colors cursor-pointer"
+        className={`h-full hover:bg-black/[0.01] dark:hover:bg-white/[0.01] transition-colors cursor-pointer ${allDisabled ? "opacity-50" : ""}`}
       >
         <div className="flex items-center justify-between">
           <div className="flex items-center gap-3">
@@ -470,14 +510,44 @@ function ProviderCard({ providerId, provider, stats, authType }) {
                 />
               </h3>
               <div className="flex items-center gap-2 text-xs flex-wrap">
-                {getStatusDisplay(connected, error, errorCode)}
-                {errorTime && <span className="text-text-muted">• {errorTime}</span>}
+                {allDisabled ? (
+                  <Badge variant="default" size="sm">
+                    <span className="flex items-center gap-1">
+                      <span className="material-symbols-outlined text-[12px]">pause_circle</span>
+                      Disabled
+                    </span>
+                  </Badge>
+                ) : (
+                  <>
+                    {getStatusDisplay(connected, error, errorCode)}
+                    {errorTime && <span className="text-text-muted">• {errorTime}</span>}
+                  </>
+                )}
               </div>
             </div>
           </div>
-          <span className="material-symbols-outlined text-text-muted opacity-0 group-hover:opacity-100 transition-opacity">
-            chevron_right
-          </span>
+          <div className="flex items-center gap-2">
+            {stats.total > 0 && (
+              <div
+                onClick={(e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                  onToggle(!allDisabled ? false : true);
+                }}
+                className=""
+              >
+                <Toggle
+                  size="sm"
+                  checked={!allDisabled}
+                  onChange={() => {}}
+                  title={allDisabled ? "Enable provider" : "Disable provider"}
+                />
+              </div>
+            )}
+            <span className="material-symbols-outlined text-text-muted opacity-0 group-hover:opacity-100 transition-opacity">
+              chevron_right
+            </span>
+          </div>
         </div>
       </Card>
     </Link>
@@ -502,8 +572,8 @@ ProviderCard.propTypes = {
 };
 
 // API Key providers - use image with textIcon fallback (same as OAuth providers)
-function ApiKeyProviderCard({ providerId, provider, stats, authType }) {
-  const { connected, error, errorCode, errorTime } = stats;
+function ApiKeyProviderCard({ providerId, provider, stats, authType, onToggle }) {
+  const { connected, error, errorCode, errorTime, allDisabled } = stats;
   const isCompatible = providerId.startsWith(OPENAI_COMPATIBLE_PREFIX);
   const isAnthropicCompatible = providerId.startsWith(ANTHROPIC_COMPATIBLE_PREFIX);
   const [imgError, setImgError] = useState(false);
@@ -531,7 +601,7 @@ function ApiKeyProviderCard({ providerId, provider, stats, authType }) {
     <Link href={`/dashboard/providers/${providerId}`} className="group">
       <Card
         padding="xs"
-        className="h-full hover:bg-black/[0.01] dark:hover:bg-white/[0.01] transition-colors cursor-pointer"
+        className={`h-full hover:bg-black/[0.01] dark:hover:bg-white/[0.01] transition-colors cursor-pointer ${allDisabled ? "opacity-50" : ""}`}
       >
         <div className="flex items-center justify-between">
           <div className="flex items-center gap-3">
@@ -564,24 +634,54 @@ function ApiKeyProviderCard({ providerId, provider, stats, authType }) {
                 />
               </h3>
               <div className="flex items-center gap-2 text-xs flex-wrap">
-                {getStatusDisplay(connected, error, errorCode)}
-                {isCompatible && (
+                {allDisabled ? (
                   <Badge variant="default" size="sm">
-                    {provider.apiType === "responses" ? "Responses" : "Chat"}
+                    <span className="flex items-center gap-1">
+                      <span className="material-symbols-outlined text-[12px]">pause_circle</span>
+                      Disabled
+                    </span>
                   </Badge>
+                ) : (
+                  <>
+                    {getStatusDisplay(connected, error, errorCode)}
+                    {isCompatible && (
+                      <Badge variant="default" size="sm">
+                        {provider.apiType === "responses" ? "Responses" : "Chat"}
+                      </Badge>
+                    )}
+                    {isAnthropicCompatible && (
+                      <Badge variant="default" size="sm">
+                        Messages
+                      </Badge>
+                    )}
+                    {errorTime && <span className="text-text-muted">• {errorTime}</span>}
+                  </>
                 )}
-                {isAnthropicCompatible && (
-                  <Badge variant="default" size="sm">
-                    Messages
-                  </Badge>
-                )}
-                {errorTime && <span className="text-text-muted">• {errorTime}</span>}
               </div>
             </div>
           </div>
-          <span className="material-symbols-outlined text-text-muted opacity-0 group-hover:opacity-100 transition-opacity">
-            chevron_right
-          </span>
+          <div className="flex items-center gap-2">
+            {stats.total > 0 && (
+              <div
+                onClick={(e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                  onToggle(!allDisabled ? false : true);
+                }}
+                className=""
+              >
+                <Toggle
+                  size="sm"
+                  checked={!allDisabled}
+                  onChange={() => {}}
+                  title={allDisabled ? "Enable provider" : "Disable provider"}
+                />
+              </div>
+            )}
+            <span className="material-symbols-outlined text-text-muted opacity-0 group-hover:opacity-100 transition-opacity">
+              chevron_right
+            </span>
+          </div>
         </div>
       </Card>
     </Link>

src/app/(dashboard)/dashboard/settings/components/AppearanceTab.tsx

@@ -1,11 +1,44 @@
 "use client";
 
+import { useState, useEffect } from "react";
 import { Card, Toggle } from "@/shared/components";
 import { useTheme } from "@/shared/hooks/useTheme";
 import { cn } from "@/shared/utils/cn";
 
 export default function AppearanceTab() {
   const { theme, setTheme, isDark } = useTheme();
+  const [settings, setSettings] = useState<Record<string, any>>({});
+  const [loading, setLoading] = useState(true);
+
+  useEffect(() => {
+    fetch("/api/settings")
+      .then((res) => {
+        if (!res.ok) {
+          throw new Error(`HTTP error ${res.status}`);
+        }
+        return res.json();
+      })
+      .then((data) => {
+        setSettings(data);
+        setLoading(false);
+      })
+      .catch(() => setLoading(false));
+  }, []);
+
+  const updateSetting = async (key: string, value: any) => {
+    try {
+      const res = await fetch("/api/settings", {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ [key]: value }),
+      });
+      if (res.ok) {
+        setSettings((prev) => ({ ...prev, [key]: value }));
+      }
+    } catch (err) {
+      console.error(`Failed to update ${key}:`, err);
+    }
+  };
 
   return (
     <Card>
@@ -53,6 +86,22 @@ export default function AppearanceTab() {
             ))}
           </div>
         </div>
+
+        <div className="pt-4 border-t border-border">
+          <div className="flex items-center justify-between">
+            <div>
+              <p className="font-medium">Hide Health Check Logs</p>
+              <p className="text-sm text-text-muted">
+                When ON, suppress [HealthCheck] messages in server console
+              </p>
+            </div>
+            <Toggle
+              checked={settings.hideHealthCheckLogs === true}
+              onChange={() => updateSetting("hideHealthCheckLogs", !settings.hideHealthCheckLogs)}
+              disabled={loading}
+            />
+          </div>
+        </div>
       </div>
     </Card>
   );

src/app/(dashboard)/dashboard/settings/components/SecurityTab.tsx

@@ -2,10 +2,12 @@
 
 import { useState, useEffect } from "react";
 import { Card, Button, Input, Toggle } from "@/shared/components";
+import { AI_PROVIDERS } from "@/shared/constants/providers";
 import IPFilterSection from "./IPFilterSection";
+import SessionInfoCard from "./SessionInfoCard";
 
 export default function SecurityTab() {
-  const [settings, setSettings] = useState({ requireLogin: false, hasPassword: false });
+  const [settings, setSettings] = useState<any>({ requireLogin: false, hasPassword: false });
   const [loading, setLoading] = useState(true);
   const [passwords, setPasswords] = useState({ current: "", new: "", confirm: "" });
   const [passStatus, setPassStatus] = useState({ type: "", message: "" });
@@ -36,6 +38,29 @@ export default function SecurityTab() {
     }
   };
 
+  const updateSetting = async (key: string, value: any) => {
+    try {
+      const res = await fetch("/api/settings", {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ [key]: value }),
+      });
+      if (res.ok) {
+        setSettings((prev) => ({ ...prev, [key]: value }));
+      }
+    } catch (err) {
+      console.error(`Failed to update ${key}:`, err);
+    }
+  };
+
+  const toggleBlockedProvider = (providerId: string) => {
+    const current: string[] = settings.blockedProviders || [];
+    const updated = current.includes(providerId)
+      ? current.filter((p) => p !== providerId)
+      : [...current, providerId];
+    updateSetting("blockedProviders", updated);
+  };
+
   const handlePasswordChange = async (e) => {
     e.preventDefault();
     if (passwords.new !== passwords.confirm) {
@@ -69,6 +94,8 @@ export default function SecurityTab() {
     }
   };
 
+  const blockedProviders: string[] = settings.blockedProviders || [];
+
   return (
     <div className="flex flex-col gap-6">
       <Card>
@@ -145,6 +172,93 @@ export default function SecurityTab() {
           )}
         </div>
       </Card>
+
+      {/* API Endpoint Protection */}
+      <Card>
+        <div className="flex items-center gap-3 mb-4">
+          <div className="p-2 rounded-lg bg-amber-500/10 text-amber-600 dark:text-amber-400">
+            <span className="material-symbols-outlined text-[20px]" aria-hidden="true">
+              api
+            </span>
+          </div>
+          <h3 className="text-lg font-semibold">API Endpoint Protection</h3>
+        </div>
+        <div className="flex flex-col gap-4">
+          {/* Require auth for /models */}
+          <div className="flex items-center justify-between">
+            <div>
+              <p className="font-medium">Require API key for /models</p>
+              <p className="text-sm text-text-muted">
+                When ON, the{" "}
+                <code className="text-xs bg-black/5 dark:bg-white/5 px-1 py-0.5 rounded">
+                  /v1/models
+                </code>{" "}
+                endpoint returns 404 for unauthenticated requests. Prevents model discovery by
+                unauthorized users.
+              </p>
+            </div>
+            <Toggle
+              checked={settings.requireAuthForModels === true}
+              onChange={() => updateSetting("requireAuthForModels", !settings.requireAuthForModels)}
+              disabled={loading}
+            />
+          </div>
+
+          {/* Blocked Providers */}
+          <div className="pt-4 border-t border-border/50">
+            <div className="mb-3">
+              <p className="font-medium">Blocked Providers</p>
+              <p className="text-sm text-text-muted">
+                Hide specific providers from the{" "}
+                <code className="text-xs bg-black/5 dark:bg-white/5 px-1 py-0.5 rounded">
+                  /v1/models
+                </code>{" "}
+                response. Blocked providers will not appear in model listings.
+              </p>
+            </div>
+            <div className="flex flex-wrap gap-2">
+              {Object.values(AI_PROVIDERS).map((provider: any) => {
+                const isBlocked = blockedProviders.includes(provider.id);
+                return (
+                  <button
+                    key={provider.id}
+                    onClick={() => toggleBlockedProvider(provider.id)}
+                    disabled={loading}
+                    className={`inline-flex items-center gap-1.5 px-2.5 py-1.5 rounded-lg text-xs font-medium transition-all border ${
+                      isBlocked
+                        ? "bg-red-500/10 border-red-500/30 text-red-600 dark:text-red-400"
+                        : "bg-black/[0.02] dark:bg-white/[0.02] border-transparent text-text-muted hover:bg-black/[0.05] dark:hover:bg-white/[0.05]"
+                    }`}
+                    title={isBlocked ? `Unblock ${provider.name}` : `Block ${provider.name}`}
+                  >
+                    <span
+                      className="material-symbols-outlined text-[14px]"
+                      style={{ color: isBlocked ? undefined : provider.color }}
+                    >
+                      {isBlocked ? "block" : provider.icon}
+                    </span>
+                    {provider.name}
+                    {isBlocked && (
+                      <span className="material-symbols-outlined text-[12px] text-red-500">
+                        close
+                      </span>
+                    )}
+                  </button>
+                );
+              })}
+            </div>
+            {blockedProviders.length > 0 && (
+              <p className="text-xs text-amber-600 dark:text-amber-400 mt-2 flex items-center gap-1">
+                <span className="material-symbols-outlined text-[14px]">warning</span>
+                {blockedProviders.length} provider{blockedProviders.length !== 1 ? "s" : ""} blocked
+                from /models
+              </p>
+            )}
+          </div>
+        </div>
+      </Card>
+
+      <SessionInfoCard />
       <IPFilterSection />
     </div>
   );

src/app/(dashboard)/dashboard/settings/components/SessionInfoCard.tsx

@@ -0,0 +1,152 @@
+"use client";
+
+/**
+ * Session Info Card — P-3
+ *
+ * Displays current session details and provides session management
+ * controls (logout, clear sessions) within the Security settings tab.
+ */
+
+import { useState, useEffect } from "react";
+import { Card, Button } from "@/shared/components";
+
+interface SessionInfo {
+  authenticated: boolean;
+  loginTime: string | null;
+  sessionAge: string;
+  ipAddress: string;
+  userAgent: string;
+}
+
+export default function SessionInfoCard() {
+  const [session, setSession] = useState<SessionInfo | null>(null);
+  const [loading, setLoading] = useState(true);
+
+  useEffect(() => {
+    let cancelled = false;
+
+    async function loadSession() {
+      // Build session info from client-side data
+      const loginTime = sessionStorage.getItem("omniroute_login_time");
+      const now = Date.now();
+
+      let sessionAge = "Unknown";
+      if (loginTime) {
+        const elapsed = now - parseInt(loginTime, 10);
+        const hours = Math.floor(elapsed / 3600000);
+        const minutes = Math.floor((elapsed % 3600000) / 60000);
+        sessionAge = hours > 0 ? `${hours}h ${minutes}m` : `${minutes}m`;
+      }
+
+      let authenticated = false;
+      try {
+        const res = await fetch("/api/auth/status", {
+          method: "GET",
+          cache: "no-store",
+        });
+        if (res.ok) {
+          const data = await res.json();
+          authenticated = data.authenticated === true;
+        }
+      } catch {
+        // Keep unauthenticated fallback on network errors.
+      }
+
+      if (cancelled) return;
+
+      setSession({
+        authenticated,
+        loginTime: loginTime ? new Date(parseInt(loginTime, 10)).toLocaleString() : null,
+        sessionAge,
+        ipAddress: "—", // Server-side only
+        userAgent: navigator.userAgent.split(" ").slice(-2).join(" ") || "Unknown",
+      });
+      setLoading(false);
+    }
+
+    loadSession();
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  const handleLogout = async () => {
+    try {
+      await fetch("/api/auth/logout", { method: "POST" });
+      sessionStorage.removeItem("omniroute_login_time");
+      window.location.href = "/";
+    } catch {
+      window.location.href = "/";
+    }
+  };
+
+  const handleClearStorage = () => {
+    if (confirm("Clear all local data? This will reset your preferences.")) {
+      localStorage.clear();
+      sessionStorage.clear();
+      window.location.reload();
+    }
+  };
+
+  if (loading) {
+    return (
+      <Card>
+        <div className="animate-pulse h-32 bg-black/5 dark:bg-white/5 rounded-lg" />
+      </Card>
+    );
+  }
+
+  return (
+    <Card>
+      <div className="flex items-center gap-3 mb-4">
+        <div className="p-2 rounded-lg bg-blue-500/10 text-blue-500">
+          <span className="material-symbols-outlined text-[20px]" aria-hidden="true">
+            person
+          </span>
+        </div>
+        <h3 className="text-lg font-semibold">Session</h3>
+      </div>
+
+      <div className="flex flex-col gap-3" role="list" aria-label="Session details">
+        <div className="flex justify-between items-center text-sm" role="listitem">
+          <span className="text-text-muted">Status</span>
+          <span className="flex items-center gap-1.5">
+            <span
+              className={`w-2 h-2 rounded-full ${session?.authenticated ? "bg-green-500" : "bg-yellow-500"}`}
+              aria-hidden="true"
+            />
+            {session?.authenticated ? "Authenticated" : "Guest"}
+          </span>
+        </div>
+
+        {session?.loginTime && (
+          <div className="flex justify-between items-center text-sm" role="listitem">
+            <span className="text-text-muted">Login Time</span>
+            <span className="font-mono text-xs">{session.loginTime}</span>
+          </div>
+        )}
+
+        <div className="flex justify-between items-center text-sm" role="listitem">
+          <span className="text-text-muted">Session Age</span>
+          <span className="font-mono text-xs">{session?.sessionAge}</span>
+        </div>
+
+        <div className="flex justify-between items-center text-sm" role="listitem">
+          <span className="text-text-muted">Browser</span>
+          <span className="font-mono text-xs truncate max-w-[200px]">{session?.userAgent}</span>
+        </div>
+      </div>
+
+      <div className="flex gap-3 mt-4 pt-4 border-t border-border/50">
+        <Button variant="secondary" onClick={handleClearStorage}>
+          Clear Local Data
+        </Button>
+        {session?.authenticated && (
+          <Button variant="danger" onClick={handleLogout}>
+            Logout
+          </Button>
+        )}
+      </div>
+    </Card>
+  );
+}

src/app/(dashboard)/dashboard/settings/error.tsx

@@ -0,0 +1,28 @@
+"use client";
+
+export default function SettingsError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  return (
+    <div className="flex flex-col items-center justify-center min-h-[400px] p-6">
+      <div className="text-center space-y-4">
+        <h2 className="text-xl font-semibold text-red-600 dark:text-red-400">
+          Failed to load settings
+        </h2>
+        <p className="text-gray-600 dark:text-gray-400 max-w-md">
+          {error.message || "An unexpected error occurred while loading settings."}
+        </p>
+        <button
+          onClick={reset}
+          className="px-4 py-2 bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
+        >
+          Try Again
+        </button>
+      </div>
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/settings/loading.tsx

@@ -0,0 +1,17 @@
+"use client";
+
+export default function SettingsLoading() {
+  return (
+    <div className="space-y-6 animate-pulse p-6">
+      <div className="h-8 bg-gray-200 dark:bg-gray-700 rounded w-36" />
+      <div className="space-y-4">
+        {[1, 2, 3, 4].map((i) => (
+          <div key={i} className="space-y-2">
+            <div className="h-4 bg-gray-200 dark:bg-gray-700 rounded w-24" />
+            <div className="h-10 bg-gray-200 dark:bg-gray-700 rounded" />
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/settings/page.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { useState } from "react";
+import { useSearchParams } from "next/navigation";
 import { cn } from "@/shared/utils/cn";
 import { APP_CONFIG } from "@/shared/constants/config";
 import SystemStorageTab from "./components/SystemStorageTab";
@@ -25,7 +26,10 @@ const tabs = [
 ];
 
 export default function SettingsPage() {
-  const [activeTab, setActiveTab] = useState("general");
+  const searchParams = useSearchParams();
+  const tabParam = searchParams.get("tab");
+  const [userSelectedTab, setUserSelectedTab] = useState(null);
+  const activeTab = userSelectedTab || tabs.find((t) => t.id === tabParam)?.id || "general";
 
   return (
     <div className="max-w-2xl mx-auto">
@@ -42,7 +46,7 @@ export default function SettingsPage() {
               role="tab"
               aria-selected={activeTab === tab.id}
               tabIndex={activeTab === tab.id ? 0 : -1}
-              onClick={() => setActiveTab(tab.id)}
+              onClick={() => setUserSelectedTab(tab.id)}
               className={cn(
                 "flex items-center gap-2 px-4 py-2 rounded-md font-medium transition-all text-sm",
                 activeTab === tab.id

src/app/(dashboard)/dashboard/usage/components/EvalsTab.tsx

@@ -184,8 +184,10 @@ export default function EvalsTab() {
 
   // Count total cases and unique models across all suites
   const totalCases = suites.reduce((sum, s) => sum + (s.cases?.length || s.caseCount || 0), 0);
-  const uniqueModels = [
-    ...new Set(suites.flatMap((s) => (s.cases || []).map((c) => c.model).filter(Boolean))),
+  const uniqueModels: string[] = [
+    ...new Set(
+      suites.flatMap((s: any) => (s.cases || []).map((c: any) => c.model)).filter(Boolean)
+    ),
   ];
 
   if (loading) {
@@ -393,8 +395,8 @@ export default function EvalsTab() {
             const caseCount = suite.cases?.length || suite.caseCount || 0;
 
             // Count unique models in this suite
-            const suiteModels = [
-              ...new Set((suite.cases || []).map((c) => c.model).filter(Boolean)),
+            const suiteModels: string[] = [
+              ...new Set<string>((suite.cases || []).map((c: any) => c.model).filter(Boolean)),
             ];
 
             return (

src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx

@@ -23,6 +23,7 @@ const PROVIDER_CONFIG = {
 const TIER_FILTERS = [
   { key: "all", label: "All" },
   { key: "enterprise", label: "Enterprise" },
+  { key: "team", label: "Team" },
   { key: "business", label: "Business" },
   { key: "ultra", label: "Ultra" },
   { key: "pro", label: "Pro" },
@@ -249,6 +250,7 @@ export default function ProviderLimits() {
     const counts = {
       all: sortedConnections.length,
       enterprise: 0,
+      team: 0,
       business: 0,
       ultra: 0,
       pro: 0,

src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx

@@ -202,7 +202,7 @@ export function parseQuotaData(provider, data) {
 
 /**
  * Normalize provider-specific plan labels into a shared tier taxonomy.
- * Supported tiers: enterprise, business, ultra, pro, free, unknown.
+ * Supported tiers: enterprise, business, team, ultra, pro, free, unknown.
  */
 export function normalizePlanTier(plan) {
   const raw = typeof plan === "string" ? plan.trim() : "";
@@ -213,10 +213,15 @@ export function normalizePlanTier(plan) {
   const upper = raw.toUpperCase();
 
   if (upper.includes("ENTERPRISE") || upper.includes("CORP") || upper.includes("ORG")) {
-    return { key: "enterprise", label: "Enterprise", variant: "info", rank: 6, raw };
+    return { key: "enterprise", label: "Enterprise", variant: "info", rank: 7, raw };
   }
 
-  if (upper.includes("BUSINESS") || upper.includes("TEAM") || upper.includes("STANDARD")) {
+  // Team plan (e.g., ChatGPT Team, GitHub Team)
+  if (upper.includes("TEAM") || upper.includes("CHATGPTTEAM")) {
+    return { key: "team", label: "Team", variant: "info", rank: 6, raw };
+  }
+
+  if (upper.includes("BUSINESS") || upper.includes("STANDARD") || upper.includes("BIZ")) {
     return { key: "business", label: "Business", variant: "warning", rank: 5, raw };
   }
 

src/app/api/auth/login/route.ts

@@ -5,12 +5,22 @@ import { SignJWT } from "jose";
 import { cookies } from "next/headers";
 import { loginSchema, validateBody } from "@/shared/validation/schemas";
 
-const SECRET = new TextEncoder().encode(
-  process.env.JWT_SECRET || "omniroute-default-secret-change-me"
-);
+// SECURITY: No hardcoded fallback — JWT_SECRET must be configured.
+if (!process.env.JWT_SECRET) {
+  console.error("[SECURITY] FATAL: JWT_SECRET is not set. Login authentication is disabled.");
+}
+const SECRET = new TextEncoder().encode(process.env.JWT_SECRET || "");
 
 export async function POST(request) {
   try {
+    // Fail-fast if JWT_SECRET is not configured
+    if (!process.env.JWT_SECRET) {
+      return NextResponse.json(
+        { error: "Server misconfigured: JWT_SECRET not set. Contact administrator." },
+        { status: 500 }
+      );
+    }
+
     const rawBody = await request.json();
 
     // Zod validation
@@ -21,15 +31,20 @@ export async function POST(request) {
     const { password } = validation.data;
     const settings = await getSettings();
 
-    // Default password is '123456' if not set
     const storedHash = settings.password;
 
     let isValid = false;
     if (storedHash) {
       isValid = await bcrypt.compare(password, storedHash);
     } else {
-      // Use env var or default
-      const initialPassword = process.env.INITIAL_PASSWORD || "123456";
+      // SECURITY: No default password — must be set via env or onboarding
+      if (!process.env.INITIAL_PASSWORD) {
+        return NextResponse.json(
+          { error: "No password configured. Complete onboarding first.", needsSetup: true },
+          { status: 403 }
+        );
+      }
+      const initialPassword = process.env.INITIAL_PASSWORD;
       isValid = password === initialPassword;
     }
 
@@ -42,7 +57,7 @@ export async function POST(request) {
 
       const token = await new SignJWT({ authenticated: true })
         .setProtectedHeader({ alg: "HS256" })
-        .setExpirationTime("24h")
+        .setExpirationTime("30d")
         .sign(SECRET);
 
       const cookieStore = await cookies();

src/app/api/auth/status/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { jwtVerify } from "jose";
+
+const SECRET = process.env.JWT_SECRET
+  ? new TextEncoder().encode(process.env.JWT_SECRET)
+  : null;
+
+export async function GET() {
+  try {
+    const cookieStore = await cookies();
+    const token = cookieStore.get("auth_token")?.value;
+
+    if (!token || !SECRET) {
+      return NextResponse.json({ authenticated: false });
+    }
+
+    await jwtVerify(token, SECRET);
+    return NextResponse.json({ authenticated: true });
+  } catch {
+    return NextResponse.json({ authenticated: false });
+  }
+}

src/app/api/cloud/auth/route.ts

@@ -20,13 +20,21 @@ export async function POST(request) {
     // Get active provider connections
     const connections = await getProviderConnections({ isActive: true });
 
-    // Map connections
+    // Helper to mask sensitive values
+    function maskSecret(value: string | null | undefined): string | null {
+      if (!value) return null;
+      if (value.length <= 8) return "****";
+      return value.slice(0, 4) + "****" + value.slice(-4);
+    }
+
+    // Map connections — NEVER expose raw credentials
     const mappedConnections = connections.map((conn) => ({
       provider: conn.provider,
       authType: conn.authType,
-      apiKey: conn.apiKey || null,
-      accessToken: conn.accessToken || null,
-      refreshToken: conn.refreshToken || null,
+      hasApiKey: !!conn.apiKey,
+      hasAccessToken: !!conn.accessToken,
+      hasRefreshToken: !!conn.refreshToken,
+      maskedApiKey: maskSecret(conn.apiKey),
       projectId: conn.projectId || null,
       expiresAt: conn.expiresAt,
       priority: conn.priority,

src/app/api/db-backups/exportAll/route.ts

@@ -60,7 +60,7 @@ export async function GET() {
       try {
         const rows = db
           .prepare(
-            "SELECT id, provider_id, display_name, auth_type, is_enabled, account_email, created_at FROM provider_connections"
+            "SELECT id, provider, name, auth_type, is_active, email, created_at FROM provider_connections"
           )
           .all();
         providers.push(...rows);
@@ -73,7 +73,9 @@ export async function GET() {
       const apiKeys: unknown[] = [];
       try {
         const rows = db
-          .prepare("SELECT id, name, prefix, created_at, is_active FROM api_keys")
+          .prepare(
+            "SELECT id, name, substr(key, 1, 8) as prefix, machine_id, created_at FROM api_keys"
+          )
           .all();
         apiKeys.push(...rows);
       } catch {

src/app/api/keys/[id]/route.ts

@@ -1,8 +1,71 @@
 import { NextResponse } from "next/server";
-import { deleteApiKey, isCloudEnabled } from "@/lib/localDb";
+import {
+  deleteApiKey,
+  getApiKeyById,
+  updateApiKeyPermissions,
+  isCloudEnabled,
+} from "@/lib/localDb";
 import { getConsistentMachineId } from "@/shared/utils/machineId";
 import { syncToCloud } from "@/lib/cloudSync";
 
+// GET /api/keys/[id] - Get single API key
+export async function GET(request, { params }) {
+  try {
+    const { id } = await params;
+    const key = await getApiKeyById(id);
+
+    if (!key) {
+      return NextResponse.json({ error: "Key not found" }, { status: 404 });
+    }
+
+    // Mask the key value
+    return NextResponse.json({
+      ...key,
+      key: key.key ? key.key.slice(0, 8) + "****" + key.key.slice(-4) : null,
+    });
+  } catch (error) {
+    console.log("Error fetching key:", error);
+    return NextResponse.json({ error: "Failed to fetch key" }, { status: 500 });
+  }
+}
+
+// PATCH /api/keys/[id] - Update API key permissions
+export async function PATCH(request, { params }) {
+  try {
+    const { id } = await params;
+    const body = await request.json();
+    const { allowedModels } = body;
+
+    // Validate allowedModels is an array
+    if (!Array.isArray(allowedModels)) {
+      return NextResponse.json({ error: "allowedModels must be an array" }, { status: 400 });
+    }
+
+    // Validate each model ID is a string
+    for (const model of allowedModels) {
+      if (typeof model !== "string") {
+        return NextResponse.json({ error: "Each model ID must be a string" }, { status: 400 });
+      }
+    }
+
+    const updated = await updateApiKeyPermissions(id, allowedModels);
+    if (!updated) {
+      return NextResponse.json({ error: "Key not found" }, { status: 404 });
+    }
+
+    // Auto sync to Cloud if enabled
+    await syncKeysToCloudIfEnabled();
+
+    return NextResponse.json({
+      message: "Permissions updated successfully",
+      allowedModels,
+    });
+  } catch (error) {
+    console.log("Error updating key permissions:", error);
+    return NextResponse.json({ error: "Failed to update permissions" }, { status: 500 });
+  }
+}
+
 // DELETE /api/keys/[id] - Delete API key
 export async function DELETE(request, { params }) {
   try {

src/app/api/keys/route.ts

@@ -8,7 +8,12 @@ import { createKeySchema, validateBody } from "@/shared/validation/schemas";
 export async function GET() {
   try {
     const keys = await getApiKeys();
-    return NextResponse.json({ keys });
+    // Mask key values — users should never see full keys after creation
+    const maskedKeys = keys.map((k) => ({
+      ...k,
+      key: k.key ? k.key.slice(0, 8) + "****" + k.key.slice(-4) : null,
+    }));
+    return NextResponse.json({ keys: maskedKeys });
   } catch (error) {
     console.log("Error fetching keys:", error);
     return NextResponse.json({ error: "Failed to fetch keys" }, { status: 500 });

src/app/api/logs/console/route.ts

@@ -0,0 +1,115 @@
+/**
+ * Console Log API — GET /api/logs/console
+ *
+ * Reads the application log file and returns entries from the last 1 hour.
+ * Supports filtering by level and limiting the number of entries.
+ *
+ * Query params:
+ *   - level: minimum log level (debug|info|warn|error) — default: all
+ *   - limit: max entries to return — default: 500
+ *   - component: filter by component/module name
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+
+const LEVEL_ORDER: Record<string, number> = {
+  trace: 5,
+  debug: 10,
+  info: 20,
+  warn: 30,
+  error: 40,
+  fatal: 50,
+};
+
+// Map pino numeric levels to string levels
+const NUMERIC_LEVEL_MAP: Record<number, string> = {
+  10: "trace",
+  20: "info",
+  30: "warn",
+  40: "error",
+  50: "fatal",
+  60: "fatal",
+};
+
+function getLogFilePath(): string {
+  return process.env.LOG_FILE_PATH || join(process.cwd(), "logs", "application", "app.log");
+}
+
+function parseLevel(raw: string | number): string {
+  if (typeof raw === "number") {
+    return NUMERIC_LEVEL_MAP[raw] || "info";
+  }
+  return String(raw).toLowerCase();
+}
+
+export async function GET(req: NextRequest) {
+  try {
+    const { searchParams } = new URL(req.url);
+    const levelFilter = searchParams.get("level") || "all";
+    const limit = Math.min(parseInt(searchParams.get("limit") || "500", 10), 2000);
+    const componentFilter = searchParams.get("component") || "";
+
+    const logPath = getLogFilePath();
+
+    if (!existsSync(logPath)) {
+      return NextResponse.json([], { status: 200 });
+    }
+
+    const raw = readFileSync(logPath, "utf-8");
+    const lines = raw.trim().split("\n").filter(Boolean);
+
+    const oneHourAgo = Date.now() - 60 * 60 * 1000;
+    const minLevel = LEVEL_ORDER[levelFilter] || 0;
+
+    const entries: any[] = [];
+
+    for (const line of lines) {
+      try {
+        const entry = JSON.parse(line);
+
+        // Filter by time (last 1 hour)
+        const ts = entry.time || entry.timestamp;
+        if (ts) {
+          const entryTime = new Date(ts).getTime();
+          if (entryTime < oneHourAgo) continue;
+        }
+
+        // Normalize level
+        entry.level = parseLevel(entry.level);
+
+        // Filter by level
+        const entryLevelNum = LEVEL_ORDER[entry.level] || 0;
+        if (minLevel > 0 && entryLevelNum < minLevel) continue;
+
+        // Filter by component
+        if (componentFilter) {
+          const comp = entry.component || entry.module || "";
+          if (!comp.toLowerCase().includes(componentFilter.toLowerCase())) continue;
+        }
+
+        // Normalize timestamp field
+        if (entry.time && !entry.timestamp) {
+          entry.timestamp = entry.time;
+        }
+
+        entries.push(entry);
+      } catch {
+        // Skip unparseable lines
+      }
+    }
+
+    // Return last N entries (most recent)
+    const result = entries.slice(-limit);
+
+    return NextResponse.json(result, {
+      status: 200,
+      headers: {
+        "Cache-Control": "no-store, no-cache, must-revalidate",
+      },
+    });
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message || "Failed to read logs" }, { status: 500 });
+  }
+}

src/app/api/models/route.ts

@@ -1,20 +1,37 @@
 import { NextResponse } from "next/server";
-import { getModelAliases, setModelAlias } from "@/models";
+import { getModelAliases, setModelAlias, getProviderConnections } from "@/models";
 import { AI_MODELS } from "@/shared/constants/config";
 
-// GET /api/models - Get models with aliases
-export async function GET() {
+// GET /api/models - Get models with aliases (only from active providers by default)
+export async function GET(request: Request) {
   try {
+    const { searchParams } = new URL(request.url);
+    const showAll = searchParams.get("all") === "true";
+
     const modelAliases = await getModelAliases();
 
-    const models = AI_MODELS.map((m) => {
+    // Get active provider connections to filter available models
+    let activeProviders: Set<string> | null = null;
+    if (!showAll) {
+      try {
+        const connections = await getProviderConnections();
+        const active = connections.filter((c: any) => c.isActive !== false);
+        activeProviders = new Set(active.map((c: any) => c.provider));
+      } catch {
+        // If DB unavailable, show all models
+      }
+    }
+
+    const models = AI_MODELS.map((m: any) => {
       const fullModel = `${m.provider}/${m.model}`;
+      const available = !activeProviders || activeProviders.has(m.provider);
       return {
         ...m,
         fullModel,
         alias: modelAliases[fullModel] || m.model,
+        available,
       };
-    });
+    }).filter((m: any) => showAll || m.available);
 
     return NextResponse.json({ models });
   } catch (error) {

src/app/api/providers/[id]/models/route.ts

@@ -198,6 +198,14 @@ const PROVIDER_MODELS_CONFIG = {
     authPrefix: "Bearer ",
     parseResponse: (data) => data.data || data.models || [],
   },
+  kilocode: {
+    url: "https://api.kilo.ai/api/openrouter/models",
+    method: "GET",
+    headers: { "Content-Type": "application/json" },
+    authHeader: "Authorization",
+    authPrefix: "Bearer ",
+    parseResponse: (data) => data.data || data.models || [],
+  },
 };
 
 /**
@@ -220,8 +228,17 @@ export async function GET(request, { params }) {
           { status: 400 }
         );
       }
-      const url = `${baseUrl.replace(/\/$/, "")}/models`;
-      const response = await fetch(url, {
+
+      let modelsUrl = baseUrl.replace(/\/$/, "");
+      if (modelsUrl.endsWith("/chat/completions")) {
+        modelsUrl = modelsUrl.slice(0, -17) + "/models";
+      } else if (modelsUrl.endsWith("/completions")) {
+        modelsUrl = modelsUrl.slice(0, -12) + "/models";
+      } else {
+        modelsUrl = `${modelsUrl}/models`;
+      }
+
+      const response = await fetch(modelsUrl, {
         method: "GET",
         headers: {
           "Content-Type": "application/json",

src/app/api/providers/[id]/test/route.ts

@@ -1,5 +1,10 @@
 import { NextResponse } from "next/server";
-import { getProviderConnectionById, updateProviderConnection, isCloudEnabled } from "@/lib/localDb";
+import {
+  getProviderConnectionById,
+  updateProviderConnection,
+  isCloudEnabled,
+  resolveProxyForConnection,
+} from "@/lib/localDb";
 import { getConsistentMachineId } from "@/shared/utils/machineId";
 import { syncToCloud } from "@/lib/cloudSync";
 import { validateProviderApiKey } from "@/lib/providers/validation";
@@ -8,6 +13,7 @@ import { getCliRuntimeStatus } from "@/shared/services/cliRuntime";
 import { getAccessToken } from "@omniroute/open-sse/services/tokenRefresh.ts";
 import { saveCallLog } from "@/lib/usageDb";
 import { logProxyEvent } from "@/lib/proxyLogger";
+import { runWithProxyContext } from "@omniroute/open-sse/utils/proxyFetch.ts";
 
 // OAuth provider test endpoints
 const OAUTH_TEST_CONFIG = {
@@ -91,7 +97,12 @@ function toSafeMessage(value: any, fallback = "Unknown error"): string {
   return trimmed || fallback;
 }
 
-function makeDiagnosis(type: string, source: string, message: string | null, code: string | null = null) {
+function makeDiagnosis(
+  type: string,
+  source: string,
+  message: string | null,
+  code: string | null = null
+) {
   return {
     type,
     source,
@@ -100,7 +111,17 @@ function makeDiagnosis(type: string, source: string, message: string | null, cod
   };
 }
 
-function classifyFailure({ error, statusCode = null, refreshFailed = false, unsupported = false }: { error: string; statusCode?: number | null; refreshFailed?: boolean; unsupported?: boolean }) {
+function classifyFailure({
+  error,
+  statusCode = null,
+  refreshFailed = false,
+  unsupported = false,
+}: {
+  error: string;
+  statusCode?: number | null;
+  refreshFailed?: boolean;
+  unsupported?: boolean;
+}) {
   const message = toSafeMessage(error, "Connection test failed");
   const normalized = message.toLowerCase();
   const numericStatus = Number.isFinite(statusCode) ? Number(statusCode) : null;
@@ -510,6 +531,14 @@ export async function testSingleConnection(connectionId: string) {
     return { valid: false, error: "Connection not found", diagnosis: null, latencyMs: 0 };
   }
 
+  // Resolve proxy for this connection (key → combo → provider → global → direct)
+  let proxyInfo: any = null;
+  try {
+    proxyInfo = await resolveProxyForConnection(connectionId);
+  } catch (proxyErr: any) {
+    console.log(`[ConnectionTest] Failed to resolve proxy for ${connectionId}:`, proxyErr?.message);
+  }
+
   let result;
   const startTime = Date.now();
   const runtime = await getProviderRuntimeStatus(connection.provider);
@@ -522,9 +551,13 @@ export async function testSingleConnection(connectionId: string) {
       diagnosis: (runtime as any).diagnosis,
     };
   } else if (connection.authType === "apikey") {
-    result = await testApiKeyConnection(connection);
+    result = await runWithProxyContext(proxyInfo?.proxy || null, () =>
+      testApiKeyConnection(connection)
+    );
   } else {
-    result = await testOAuthConnection(connection);
+    result = await runWithProxyContext(proxyInfo?.proxy || null, () =>
+      testOAuthConnection(connection)
+    );
   }
 
   const latencyMs = Date.now() - startTime;
@@ -591,9 +624,9 @@ export async function testSingleConnection(connectionId: string) {
   try {
     logProxyEvent({
       status: result.valid ? "success" : "error",
-      proxy: null,
-      level: "provider-test",
-      levelId: null,
+      proxy: proxyInfo?.proxy || null,
+      level: proxyInfo?.level || "provider-test",
+      levelId: proxyInfo?.levelId || null,
       provider: connection.provider,
       targetUrl: `${connection.provider}/connection-test`,
       latencyMs,

src/app/api/settings/require-login/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
-import { getSettings } from "@/lib/localDb";
+import { getSettings, updateSettings } from "@/lib/localDb";
+import bcrypt from "bcryptjs";
 
 export async function GET() {
   try {
@@ -10,3 +11,43 @@ export async function GET() {
     return NextResponse.json({ requireLogin: true }, { status: 200 });
   }
 }
+
+/**
+ * POST /api/settings/require-login — Set password and/or toggle requireLogin.
+ * Used by the onboarding wizard security step.
+ */
+export async function POST(request: Request) {
+  try {
+    const body = await request.json();
+    const { requireLogin, password } = body;
+
+    const updates: Record<string, any> = {};
+
+    if (typeof requireLogin === "boolean") {
+      updates.requireLogin = requireLogin;
+    }
+
+    if (password && typeof password === "string" && password.length >= 4) {
+      const hashedPassword = await bcrypt.hash(password, 12);
+      updates.password = hashedPassword;
+    } else if (password) {
+      return NextResponse.json(
+        { error: "Password must be at least 4 characters" },
+        { status: 400 }
+      );
+    }
+
+    if (Object.keys(updates).length === 0) {
+      return NextResponse.json({ error: "No valid fields to update" }, { status: 400 });
+    }
+
+    await updateSettings(updates);
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error("[API] Error updating require-login settings:", error);
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : "Failed to update settings" },
+      { status: 500 }
+    );
+  }
+}

src/app/api/settings/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { getSettings, updateSettings } from "@/lib/localDb";
+import { clearHealthCheckLogCache } from "@/lib/tokenHealthCheck";
 import bcrypt from "bcryptjs";
 import { updateSettingsSchema, validateBody } from "@/shared/validation/schemas";
 
@@ -61,6 +62,12 @@ export async function PATCH(request) {
     }
 
     const settings = await updateSettings(body);
+
+    // Clear health check log cache if that setting was updated
+    if ("hideHealthCheckLogs" in body) {
+      clearHealthCheckLogCache();
+    }
+
     const { password, ...safeSettings } = settings;
     return NextResponse.json(safeSettings);
   } catch (error) {

src/app/api/tags/route.ts

@@ -1,11 +1,6 @@
+import { CORS_HEADERS } from "@/shared/utils/cors";
 import { ollamaModels } from "@omniroute/open-sse/config/ollamaModels.ts";
 
-const CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, OPTIONS",
-  "Access-Control-Allow-Headers": "*",
-};
-
 export async function OPTIONS() {
   return new Response(null, { headers: CORS_HEADERS });
 }

src/app/api/v1/api/chat/route.ts

@@ -1,3 +1,4 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { handleChat } from "@/sse/handlers/chat";
 import { initTranslators } from "@omniroute/open-sse/translator/index.ts";
 import { transformToOllama } from "@omniroute/open-sse/utils/ollamaTransform.ts";
@@ -15,7 +16,7 @@ async function ensureInitialized() {
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },

src/app/api/v1/audio/speech/route.ts

@@ -1,3 +1,4 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { handleAudioSpeech } from "@omniroute/open-sse/handlers/audioSpeech.ts";
 import { getProviderCredentials, extractApiKey, isValidApiKey } from "@/sse/services/auth";
 import { parseSpeechModel } from "@omniroute/open-sse/config/audioRegistry.ts";
@@ -10,7 +11,7 @@ import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "POST, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },

src/app/api/v1/audio/transcriptions/route.ts

@@ -1,3 +1,4 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { handleAudioTranscription } from "@omniroute/open-sse/handlers/audioTranscription.ts";
 import { getProviderCredentials, extractApiKey, isValidApiKey } from "@/sse/services/auth";
 import { parseTranscriptionModel } from "@omniroute/open-sse/config/audioRegistry.ts";
@@ -10,7 +11,7 @@ import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "POST, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },

src/app/api/v1/chat/completions/route.ts

@@ -1,9 +1,14 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { callCloudWithMachineId } from "@/shared/utils/cloud";
 import { handleChat } from "@/sse/handlers/chat";
 import { initTranslators } from "@omniroute/open-sse/translator/index.ts";
+import { createInjectionGuard } from "@/middleware/promptInjectionGuard";
 
 let initPromise = null;
 
+// Singleton injection guard instance
+const injectionGuard = createInjectionGuard();
+
 /**
  * Initialize translators once (Promise-based singleton — no race condition)
  */
@@ -22,7 +27,7 @@ function ensureInitialized() {
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },
@@ -30,8 +35,31 @@ export async function OPTIONS() {
 }
 
 export async function POST(request) {
-  // Fallback to local handling
   await ensureInitialized();
 
+  // Prompt injection guard — inspect body before forwarding
+  try {
+    const cloned = request.clone();
+    const body = await cloned.json().catch(() => null);
+    if (body) {
+      const { blocked, result } = injectionGuard(body);
+      if (blocked) {
+        return new Response(
+          JSON.stringify({
+            error: {
+              message: "Request blocked: potential prompt injection detected",
+              type: "injection_detected",
+              code: "SECURITY_001",
+              detections: result.detections.length,
+            },
+          }),
+          { status: 400, headers: { "Content-Type": "application/json" } }
+        );
+      }
+    }
+  } catch {
+    // Don't block on guard errors — fail open
+  }
+
   return await handleChat(request);
 }

src/app/api/v1/embeddings/route.ts

@@ -1,3 +1,4 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { handleEmbedding } from "@omniroute/open-sse/handlers/embeddings.ts";
 import { getProviderCredentials, extractApiKey, isValidApiKey } from "@/sse/services/auth";
 import {
@@ -15,7 +16,7 @@ import { toJsonErrorPayload } from "@/shared/utils/upstreamError";
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },

src/app/api/v1/images/generations/route.ts

@@ -1,3 +1,4 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { handleImageGeneration } from "@omniroute/open-sse/handlers/imageGeneration.ts";
 import { getProviderCredentials, extractApiKey, isValidApiKey } from "@/sse/services/auth";
 import { parseImageModel, getAllImageModels } from "@omniroute/open-sse/config/imageRegistry.ts";
@@ -12,7 +13,7 @@ import { toJsonErrorPayload } from "@/shared/utils/upstreamError";
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },
@@ -92,15 +93,15 @@ export async function POST(request) {
   const result = await handleImageGeneration({ body, credentials, log });
 
   if (result.success) {
-    return new Response(JSON.stringify(result.data), {
+    return new Response(JSON.stringify((result as any).data), {
       status: 200,
       headers: { "Content-Type": "application/json" },
     });
   }
 
-  const errorPayload = toJsonErrorPayload(result.error, "Image generation provider error");
+  const errorPayload = toJsonErrorPayload((result as any).error, "Image generation provider error");
   return new Response(JSON.stringify(errorPayload), {
-    status: result.status,
+    status: (result as any).status,
     headers: { "Content-Type": "application/json" },
   });
 }

src/app/api/v1/messages/count_tokens/route.ts

@@ -1,8 +1,4 @@
-const CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "POST, OPTIONS",
-  "Access-Control-Allow-Headers": "*",
-};
+import { CORS_HEADERS } from "@/shared/utils/cors";
 
 /**
  * Handle CORS preflight

src/app/api/v1/messages/route.ts

@@ -1,3 +1,4 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { handleChat } from "@/sse/handlers/chat";
 import { initTranslators } from "@omniroute/open-sse/translator/index.ts";
 
@@ -20,7 +21,7 @@ async function ensureInitialized() {
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },

src/app/api/v1/models/route.ts

@@ -1,6 +1,10 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { PROVIDER_MODELS, PROVIDER_ID_TO_ALIAS } from "@/shared/constants/models";
 import { AI_PROVIDERS } from "@/shared/constants/providers";
-import { getProviderConnections, getCombos, getAllCustomModels } from "@/lib/localDb";
+import { getProviderConnections, getCombos, getAllCustomModels, getSettings } from "@/lib/localDb";
+import { extractApiKey, isValidApiKey } from "@/sse/services/auth";
+import { jwtVerify } from "jose";
+import { cookies } from "next/headers";
 import { getAllEmbeddingModels } from "@omniroute/open-sse/config/embeddingRegistry.ts";
 import { getAllImageModels } from "@omniroute/open-sse/config/imageRegistry.ts";
 import { getAllRerankModels } from "@omniroute/open-sse/config/rerankRegistry.ts";
@@ -82,7 +86,7 @@ function buildAliasMaps() {
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "GET, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },
@@ -93,19 +97,76 @@ export async function OPTIONS() {
  * GET /v1/models - OpenAI compatible models list
  * Returns models from all active providers, combos, embeddings, and image models in OpenAI format
  */
-export async function GET() {
+export async function GET(request: Request) {
   try {
+    // Issue #100: Optionally require authentication for /models (security hardening)
+    // When enabled, unauthenticated requests get 401 with proper error response.
+    // Supports API key (Bearer token) for external clients and JWT cookie for dashboard.
+    let settings: Record<string, any> = {};
+    try {
+      settings = await getSettings();
+    } catch {}
+    if (settings.requireAuthForModels === true) {
+      // Check authentication: API key OR dashboard session (JWT cookie)
+      // Supports dual auth: Bearer token for external clients, cookie for dashboard.
+      let isAuthenticated = false;
+
+      // 1. Check API key (for external clients)
+      const apiKey = extractApiKey(request);
+      if (apiKey && (await isValidApiKey(apiKey))) {
+        isAuthenticated = true;
+      }
+
+      // 2. Check JWT cookie (for dashboard session)
+      // The auth_token cookie has sameSite:lax + httpOnly, which already
+      // prevents cross-origin abuse — no additional origin check needed.
+      // Same pattern as shared/utils/apiAuth.ts verifyAuth().
+      if (!isAuthenticated && process.env.JWT_SECRET) {
+        try {
+          const cookieStore = await cookies();
+          const token = cookieStore.get("auth_token")?.value;
+          if (token) {
+            const secret = new TextEncoder().encode(process.env.JWT_SECRET);
+            await jwtVerify(token, secret);
+            isAuthenticated = true;
+          }
+        } catch {
+          // Invalid/expired token or cookies not available — not authenticated
+        }
+      }
+
+      if (!isAuthenticated) {
+        return Response.json(
+          {
+            error: {
+              message: "Authentication required",
+              type: "invalid_request_error",
+              code: "invalid_api_key",
+            },
+          },
+          { status: 401 }
+        );
+      }
+    }
+
     const { aliasToProviderId, providerIdToAlias } = buildAliasMaps();
 
+    // Issue #96: Allow blocking specific providers from the models list
+    const blockedProviders: Set<string> = new Set(
+      Array.isArray(settings.blockedProviders) ? settings.blockedProviders : []
+    );
+
     // Get active provider connections
     let connections = [];
+    let totalConnectionCount = 0; // Track if DB has ANY connections (even disabled)
     try {
       connections = await getProviderConnections();
+      totalConnectionCount = connections.length;
       // Filter to only active connections
       connections = connections.filter((c) => c.isActive !== false);
     } catch (e) {
-      // If database not available, return all models
-      console.log("Could not fetch providers, returning all models");
+      // If database not available, show no provider models (safe default)
+      console.log("Could not fetch providers, showing only combos/custom models");
     }
 
     // Get combos
@@ -128,8 +189,9 @@ export async function GET() {
     const models = [];
     const timestamp = Math.floor(Date.now() / 1000);
 
-    // Add combos first (they appear at the top)
+    // Add combos first (they appear at the top) — only active ones
     for (const combo of combos) {
+      if (combo.isActive === false) continue;
       models.push({
         id: combo.name,
         object: "model",
@@ -146,12 +208,11 @@ export async function GET() {
       const providerId = aliasToProviderId[alias] || alias;
       const canonicalProviderId = FALLBACK_ALIAS_TO_PROVIDER[alias] || providerId;
 
-      // If we have active providers, only include those; otherwise include all
-      if (
-        connections.length > 0 &&
-        !activeAliases.has(alias) &&
-        !activeAliases.has(canonicalProviderId)
-      ) {
+      // Skip blocked providers (Issue #96)
+      if (blockedProviders.has(alias) || blockedProviders.has(canonicalProviderId)) continue;
+
+      // Only include models from providers with active connections
+      if (!activeAliases.has(alias) && !activeAliases.has(canonicalProviderId)) {
         continue;
       }
 
@@ -183,8 +244,16 @@ export async function GET() {
       }
     }
 
-    // Add embedding models
+    // Helper: check if a provider is active (by provider id or alias)
+    const isProviderActive = (provider: string) => {
+      if (activeAliases.size === 0) return false; // No active connections = show nothing
+      const alias = providerIdToAlias[provider] || provider;
+      return activeAliases.has(alias) || activeAliases.has(provider);
+    };
+
+    // Add embedding models (filtered by active providers)
     for (const embModel of getAllEmbeddingModels()) {
+      if (!isProviderActive(embModel.provider)) continue;
       models.push({
         id: embModel.id,
         object: "model",
@@ -195,8 +264,9 @@ export async function GET() {
       });
     }
 
-    // Add image models
+    // Add image models (filtered by active providers)
     for (const imgModel of getAllImageModels()) {
+      if (!isProviderActive(imgModel.provider)) continue;
       models.push({
         id: imgModel.id,
         object: "model",
@@ -207,8 +277,9 @@ export async function GET() {
       });
     }
 
-    // Add rerank models
+    // Add rerank models (filtered by active providers)
     for (const rerankModel of getAllRerankModels()) {
+      if (!isProviderActive(rerankModel.provider)) continue;
       models.push({
         id: rerankModel.id,
         object: "model",
@@ -218,8 +289,9 @@ export async function GET() {
       });
     }
 
-    // Add audio models (transcription + speech)
+    // Add audio models (filtered by active providers)
     for (const audioModel of getAllAudioModels()) {
+      if (!isProviderActive(audioModel.provider)) continue;
       models.push({
         id: audioModel.id,
         object: "model",
@@ -230,8 +302,9 @@ export async function GET() {
       });
     }
 
-    // Add moderation models
+    // Add moderation models (filtered by active providers)
     for (const modModel of getAllModerationModels()) {
+      if (!isProviderActive(modModel.provider)) continue;
       models.push({
         id: modModel.id,
         object: "model",
@@ -247,11 +320,12 @@ export async function GET() {
       for (const [providerId, providerCustomModels] of Object.entries(customModelsMap)) {
         const alias = providerIdToAlias[providerId] || providerId;
         const canonicalProviderId = FALLBACK_ALIAS_TO_PROVIDER[alias] || providerId;
-        // Only include if provider is active (or no connections configured)
+        // Only include if provider is active — check alias, canonical ID, or raw providerId
+        // (raw check needed for OpenAI-compatible providers whose ID isn't in the alias map)
         if (
-          connections.length > 0 &&
           !activeAliases.has(alias) &&
-          !activeAliases.has(canonicalProviderId)
+          !activeAliases.has(canonicalProviderId) &&
+          !activeAliases.has(providerId)
         )
           continue;
 
@@ -298,7 +372,7 @@ export async function GET() {
       },
       {
         headers: {
-          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Origin": CORS_ORIGIN,
         },
       }
     );

src/app/api/v1/moderations/route.ts

@@ -1,3 +1,4 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { handleModeration } from "@omniroute/open-sse/handlers/moderations.ts";
 import { getProviderCredentials, extractApiKey, isValidApiKey } from "@/sse/services/auth";
 import { parseModerationModel } from "@omniroute/open-sse/config/moderationRegistry.ts";
@@ -10,7 +11,7 @@ import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "POST, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },

src/app/api/v1/providers/[provider]/chat/completions/route.ts

@@ -1,3 +1,4 @@
+import { CORS_ORIGIN } from "@/shared/utils/cors";
 import { handleChat } from "@/sse/handlers/chat";
 import { initTranslators } from "@omniroute/open-sse/translator/index.ts";
 import { errorResponse } from "@omniroute/open-sse/utils/error.ts";
@@ -19,7 +20,7 @@ async function ensureInitialized() {
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Origin": CORS_ORIGIN,
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },