Repository navigation
chore: sync 116 upstream commits and preserve Pinable host compatibility on v8 - #4
Merged
Merged
Conversation
- Accept zero TTFT duration to accommodate sub-tick loopback responses - Add unit test verifying zero TTFT validation in usage records Closes: router-for-me#5996
…block (router-for-me#5432) Anthropic only accepts cache_control on the tool_result block itself; placing it inside tool_result.content is rejected with a 400 ("cache_control may not be specified within tool_result.content"). The OpenAI-to-Claude request translator ran tool message content parts through the same converter as regular message parts, which copies part-level cache_control onto every converted part. Clients that attach cache_control to tool output parts therefore produced a payload with the marker in two places: on the tool_result block (correct, from the message-level path) and nested inside tool_result.content[0] (rejected). Strip the marker from parts converted inside tool_result.content, and hoist the first source part's cache_control onto the tool_result block before AttachMessageCacheControl runs, so a part-level marker still wins over a message-level one, matching the existing priority. Regular message parts keep their part-level cache_control. Fixes router-for-me#5429 Generated-by: GLM-5.3-Flash (ZCode)
- Allow prewarm requests to be handled locally after an existing request turn - Reset transcript root for mid-connection prewarms that omit `previous_response_id` - Reuse local prewarm evaluation flag across request normalization and response handling Closes: router-for-me#6006
…treams - Filter internal `responsesapi.` telemetry and private `codex.` events from SSE output - Preserve Codex response metadata for official Codex clients while dropping rate limits - Discard frames matching filtered event names or payload types in the SSE framer Closes: router-for-me#6007
…lag to usage plugins - Add `ResponseServiceTier`, `ResponseModel`, and `Stream` fields to `pluginapi.UsageRecord` - Propagate upstream response model, service tier, and stream status in usage translation adapter Closes: router-for-me#6008
- Infer `array` type or remove `items` on non-array nodes to satisfy Gemini schema validation - Prioritize `array` type when flattening union types for properties declaring `items` - Infer `type: array` during tool schema normalization when `items` is defined without an explicit type Closes: router-for-me#6011
Sync the verified xAI catalog entry, including native web search and thinking levels.
Match the upstream models repository, which no longer publishes this Codex model.
Match the models repository: Grok 4.7 has no separate text output cap.
- Add context helpers to manage execution-scoped proxy overrides - Prioritize request proxy over credential and global proxy settings across HTTP and uTLS clients - Propagate request proxy in conductor execution and plugin host adapters - Isolate Codex WebSocket connection reuse by proxy endpoint Closes: router-for-me#6013
…-schema-batch perf(codex): batch tool schema rewrites
…quest-cache-pr perf: cache Responses request validation and index tool declarations
Skip the second compatibility translation for Claude, Gemini, and Gemini interactions when the baseline and working payloads share a backing array and no plugin hooks are installed. Keep independent buffers, the existing hook order, and native interactions copies.
…am-copy perf(codex): avoid discarded copies of SSE data lines
Read Gemini interactions scanner lines directly because emitted frames are already cloned before reuse, and allocate each Kimi responses passthrough chunk once so it stays owned without a second copy.
- Strip octal NUL (`\0`) escapes in regex patterns to prevent rejection by strict upstream JSON Schema validators - Update tool schema normalization fast-path to check for serialized `\0` escape sequences Closes: router-for-me#6025
- Support string `input` by appending it as a user text message - Initialize message capacity when `input` is a string Closes: router-for-me#6028
…spension - Count unavailable clients only once when marked as both quota-exceeded and suspended in model availability and count calculations Closes: router-for-me#6036
- Convert `input_video` and `video_url` content parts to chat completion video parts - Preserve video URL and processing options for upstream handling Closes: router-for-me#6037
…ints - Allow patching `priority` field for Gemini, Interactions, OpenAI compatibility, Vertex, and Codex credentials - Update configuration entries with new priority value when present in patch payload Closes: router-for-me#6039
- Emit warnings when unrecognized configuration sections are commented out during v8 migration - Mirror migration warnings directly to the console when file logging is active - Provide a hook in the configuration package to customize migration warning dispatching Closes: router-for-me#6162
- Add `SanitizeMetaWebSearchTools` to remove `search_content_types` from `web_search` tool definitions - Support sanitizing nested tools within `namespace` tool definitions - Apply web search tool sanitization during Meta request preparation Closes: router-for-me#6156
- Parse and pass `quality` in xAI image generation and edit requests - Extract `quality` field from JSON payloads and multipart form data - Include `quality` in the upstream xAI image request payload when provided Closes: router-for-me#6157
…nses tools - Update namespace qualification check to require an exact match or explicit delimiter prefix - Prevent tools sharing a name prefix with a namespace from skipping qualification Closes: router-for-me#6160
- Add trailing blank-line terminator to frames created by `SSEEventData` - Ensure concatenated SSE frames remain separable downstream Closes: router-for-me#6161
- Preserve thought signatures across function calls, thought steps, and trailing empty text parts - Track pending signatures and model turn context when constructing Gemini request contents - Support extracting thought steps from response parts with thought signatures during response conversion Closes: router-for-me#6150
- Include `bond` interface prefix in physical LAN interface detection - Suppress repetitive discovery service spec build failure warnings until error message or configuration changes
…gration - Traverse nested configuration paths to comment out unrecognized fields during v8 migration - Remove deprecated Codex `identity-confuse` configuration option and request handling - Clean up identity confuse mapping logic from Codex HTTP and WebSocket executors
…ests
- Rewrite blank string `arguments` on `function_call` items to `{}` in OpenAI Responses requests
- Prevent upstream rejection of parameter-less tool calls requiring valid JSON arguments
Closes: router-for-me#6173
- Rewrite `tool.name` of mid-conversation `tool_addition`/`tool_removal` blocks with a `tool_reference` to the same MCP alias as `tools[]` - Rewrite `tool.definition.name` of inline `tool_definition` additions that redefine a declared custom tool - Apply the same rewrite in the batched-edits and legacy remap paths - Prevent upstream `references unknown tool` 400s for cloaked requests using mid-conversation tool changes Closes: router-for-me#6174
- Extract `plan_type` from JWT claims and default missing values to `free` - Include `plan_type` in token data, token storage, auth attributes, and file synthesis - Ensure `plan_type` is maintained across token refresh flows - Preserve empty map allocations during auth object cloning
Use Home credential options as authoritative model capability configuration for compat handling and prompt cache behavior. Expose quota provider operations through the public plugin host API.
…l-change-alias fix(claude): remap MCP aliases in tool_addition/tool_removal blocks
- Generate UUIDv7 request IDs using crypto random source - Add `ShortRequestID` helper to truncate IDs to 8 trailing characters in log output and filenames - Update management log handlers to match log files using short request IDs
- Add `oauth-settings` configuration to override model capabilities such as `max-context-length` - Implement sanitization, YAML preservation, and live reload diff detection for OAuth settings - Apply OAuth model settings during model resolution and Codex model list responses Closes: router-for-me#6099
- Register Claude Sonnet 5.5 model configuration with thinking capabilities and context limits
Add explicit JSON-body support to the smoke HTTP helper while preserving existing GET and empty shutdown-POST behavior. Add four isolated helper regressions for payloads, authentication, proxy isolation, and error responses. All 32 packaging/publication/helper tests pass locally; native and full PR checks must rerun on this head.
PinableAgents
marked this pull request as ready for review
September 30, 2026 02:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completed: upstream synchronized and merged into main
Merged with a normal merge commit as 293962a. Post-merge reads confirm this is
PinableAgents/CLIProxyAPI:main; upstreamrouter-for-me/CLIProxyAPI:mainis still a270e7b. The comparison reports behind_by=0, with that exact upstream commit as the merge base.This integrates 116 upstream commits since a5ab695, retaining original fork main 2eb0578 and its 25 fork-only commits. Integration commit c70aef4 preserves the fork and upstream as its two ordered parents. No squash/rebase, reset, force push or protection bypass.
The final merged code tree 872b25eaab12ff87c6c9229540d420330e0ddeb2 is byte-identical to the validated head dc829d4 and actual PR merge-result ef92cca. Base main and PR head were checked before merging; the merge API was bound to that validated head SHA.
Four conflicts and v8 compatibility
The four real text conflicts were import blocks in:
Combine all imports required by both implementations using upstream's
/v8module path, without whole-file ours/theirs selection. Seven fork-only Go files also migrate from v7 to v8 imports. Keep all automatically merged upstream updates and the fork-specific implementation.Desktop host contract remains version 1: configuration-free version probes, parent supervision, authenticated v0 runtime-info/runtime-shutdown with actual-loopback checking, service-scoped in-memory ephemeral keys, reload survival and non-persistence. Preserve the isolated host_runtime.go and builder_runtime.go integrations and the atomic config-directory watch fix. Six-platform packaging and manual-only publication policy remain unchanged.
Upgrade note: code importing the Go SDK must use the v8 module path. The new v8 management API reads legacy configuration without rewriting it; a v8 configuration write migrates the persisted layout. The old host-control endpoints remain available and were tested after that migration. See docs/pinable/upstream-sync.md and docs/pinable/desktop-runtime.md. No Desktop lock is changed automatically.
Additional regression protection
The Interactions/Gemini import-boundary guard now recognizes numbered module-major paths instead of silently missing v8. Positive/negative cases protect the matcher; this extra fix changes no production translator logic.
Native packaged-executable smoke now proves that unauthenticated/public credentials cannot access v8 management; an authenticated client-key PUT migrates the layout and reloads the new key; the preceding configured key is rejected; the ephemeral key and old v0 host control survive; and the ephemeral key is not persisted. Existing version/discovery/atomic-replacement/parent-death/loopback-shutdown checks remain intact.
The first candidate's new JSON PUT exposed a request-helper argument mismatch. The helper was fixed to send exact JSON bytes and Content-Type while retaining original GET and empty shutdown-POST behavior. Four isolated helper regressions were added. Failed or superseded native runs were not accepted for merge.
Completed validation before merge
All results below correspond to dc829d4 or its byte-identical PR merge tree:
Full PR regression: https://github.com/PinableAgents/CLIProxyAPI/actions/runs/36661510873
PR build: https://github.com/PinableAgents/CLIProxyAPI/actions/runs/36661510879
Six-platform runtime and complete-set validation: https://github.com/PinableAgents/CLIProxyAPI/actions/runs/36661510847
Independently downloaded the validated Linux amd64 artifact, checked its GitHub ZIP digest 71023768c25184e2e8096583061258ced0cab54124b72927d760ade9665bdc62, source SHA and manifest, then ran the actual binary through the entire smoke sequence outside Actions: passed, including v8 layout migration and legacy host-control compatibility. Binary SHA256: 1322caf7c2ab5ef519d8990e6d38e7141b5efcfa31ed1fae148c9f7f98b79ea4.
No live provider credentials or historical conversation keys were used. These checks do not certify external provider APIs, third-party dynamic plugins, or complete Wails/Desktop packaging.
Preparation, cleanup and publication boundary
The maintained sync script performed the real merge/build/full tests in https://github.com/PinableAgents/CLIProxyAPI/actions/runs/36660856870 . Its final branch push was rejected because the Actions token cannot update workflow files. The existing authorized GitHub connection then created the branch at that exact already-validated commit. No token scopes, permissions or protections were changed.
Temporary diagnostic/integration drivers and patch transport were removed from their isolated maintenance branch and are absent from this PR. No Release, tag, deployment, Desktop component-lock update, disabled check or weakened assertion was introduced.
The main push has triggered separate post-merge CI and runtime builds. The completed results above are the validated pre-merge runs, not a claim that those later main runs have finished. Main regression run: https://github.com/PinableAgents/CLIProxyAPI/actions/runs/36662183751 . Runtime artifacts from the PR are source-pinned to dc829d4; a new main build will carry its own merge SHA. No new runtime Release was published by this synchronization.