Upload 22 files

.dockerignore

@@ -9,7 +9,6 @@
 # Dependencies and build output
 node_modules
 .next
-.build
 out
 build
 dist
@@ -31,95 +30,3 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 .pnpm-debug.log*
-
-# Test suites
-tests
-test-results
-playwright-report
-blob-report
-
-# Documentation
-# Issue #2348: The Dashboard Docs viewer reads markdown from `/app/docs` at
-# runtime. The previous `docs/*` block hid every file except openapi.yaml,
-# so the in-product help screen failed with ENOENT for every page.
-# We now keep the English markdown tree plus the docs assets imported by MDX
-# during `next build`, while still dropping the bulky translated docs and
-# extra raster diagram sources that account for most of the docs footprint
-# of the ~50 MB docs directory. The Docs viewer reads the default-locale
-# (English) sources at runtime, so translations are not required in the
-# container image.
-docs/i18n/**
-docs/diagrams/**/*.png
-docs/diagrams/**/*.jpg
-docs/diagrams/**/*.jpeg
-docs/diagrams/**/*.gif
-docs/diagrams/**/*.webp
-# Note: `*.md` matches the root only (Go filepath.Match does not cross /),
-# so nested docs/**/*.md is implicitly kept without a re-include rule.
-*.md
-!README.md
-
-# Electron (separate build)
-electron
-
-# VS Code extension (separate project)
-vscode-extension
-
-# Build artifacts
-*.tgz
-*.AppImage
-*.deb
-*.rpm
-
-# Package manager lock (bun)
-bun.lock
-
-# Agent config
-.agents
-.gemini
-
-# Misc
-llm.txt
-images
-clipr
-omnirouteCloud
-omnirouteSite
-
-# Temporary/Scratch Folders
-_*
-
-# CI/CD and Version Control (that are not actual code)
-.github
-.husky
-.omc
-
-# Test Configs and Reports
-playwright.config.ts
-vitest*.ts
-audit-report.json
-sonar-project.properties
-
-# Deployment Configs
-docker-compose*.yml
-fly.toml
-
-# Consistent with .gitignore
-.DS_Store
-.idea/
-.config/
-.data/
-.omnivscodeagent/
-*.sqlite-*
-*.tsbuildinfo
-next-env.d.ts
-security-analysis/
-.analysis/
-antigravity-manager-analysis/
-.sisyphus/
-.plans/
-app.__qa_backup/
-.app-build-backup-*/
-.gitnexus
-.worktrees
-.next-playwright/
-cloud/

.env.example

@@ -1,1461 +1,41 @@
-# ┌─────────────────────────────────────────────────────────────────────────────┐
-# │                          OmniRoute — .env Contract                          │
-# │  This file documents EVERY environment variable read by the runtime.        │
-# │  Copy to .env and adjust values. Lines starting with # are commented out    │
-# │  (optional / off-by-default). Uncomment only what you need.                 │
-# │  Reference: docs/ENVIRONMENT.md for full details and usage scenarios.       │
-# └─────────────────────────────────────────────────────────────────────────────┘
+# 9Router environment contract
+# This file reflects actual runtime usage in the current codebase.
 
-# ═══════════════════════════════════════════════════════════════════════════════
-# 1. REQUIRED SECRETS — Must be set before first run!
-# ═══════════════════════════════════════════════════════════════════════════════
-# These secrets are critical for security. Generate strong, unique values.
+# Required
+JWT_SECRET=change-me-to-a-long-random-secret
+INITIAL_PASSWORD=change-me
+DATA_DIR=/var/lib/9router
 
-# JWT signing key for dashboard session tokens.
-# Used by: src/lib/auth — signs/verifies all authenticated session cookies.
-# Generate: openssl rand -base64 48
-JWT_SECRET=
-
-# Encryption key for API keys stored in the database.
-# Used by: src/lib/db/apiKeys.ts — encrypts API key values at rest in SQLite.
-# Generate: openssl rand -hex 32
-API_KEY_SECRET=
-
-# Initial admin login password — CHANGE THIS before first use!
-# Used by: bootstrap only — sets the initial dashboard password on first boot.
-# After first login you can change it from Dashboard → Settings → Security.
-# Default: CHANGEME (insecure, for local dev only)
-INITIAL_PASSWORD=CHANGEME
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 2. STORAGE & DATABASE
-# ═══════════════════════════════════════════════════════════════════════════════
-# OmniRoute uses SQLite for all persistence. These variables control where
-# data lives, encryption, and cleanup policies.
-
-# Base directory for all persistent data (SQLite DB, logs, backups).
-# Used by: src/lib/db/core.ts — resolves the SQLite database file path.
-# Default: ~/.omniroute/  |  Override for Docker or custom installations.
-# Hint: When running in Docker, consider mounting a host directory here for data persistence across container restarts
-#       also if you want to share the same database as "npm run dev" use "./data"
-# DATA_DIR=/var/lib/omniroute
-
-# Encryption key for SQLite database encryption at rest.
-# Used by: src/lib/db/encryption.ts — encrypts the entire SQLite database.
-# Generate: openssl rand -hex 32  |  Leave empty to disable DB encryption.
-STORAGE_ENCRYPTION_KEY=
-
-# Version tag for the encryption key — allows future key rotation.
-# Used by: scripts/bootstrap-env.mjs, electron/main.js — persists key version.
-# Default: v1  |  Increment when rotating STORAGE_ENCRYPTION_KEY.
-STORAGE_ENCRYPTION_KEY_VERSION=v1
-
-# Automatic SQLite backup on startup.
-# Used by: src/lib/db/backup.ts — creates a timestamped backup before migrations.
-# Default: false (backups enabled)  |  Set true to skip backup on every restart.
-DISABLE_SQLITE_AUTO_BACKUP=false
-
-# ── Redis (Rate Limiting) ──
-# Redis connection URL for the rate limiter backend.
-# Used by: src/shared/utils/rateLimiter.ts
-# Default: redis://localhost:6379 (or redis://redis:6379 in Docker)
-REDIS_URL=redis://localhost:6379
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 3. NETWORK & PORTS
-# ═══════════════════════════════════════════════════════════════════════════════
-# OmniRoute can run on a single port (default) or split Dashboard/API ports.
-
-# Canonical port for both Dashboard UI and API (single-port mode).
-# Used by: src/lib/runtime/ports.ts — base port for the Next.js server.
-# Default: 20128
+# Recommended runtime variables
 PORT=20128
-
-# Split-port mode: serve Dashboard and API on separate ports for network isolation.
-# Used by: src/lib/runtime/ports.ts — overrides PORT for each service.
-# API_PORT=20129
-# API_HOST=0.0.0.0
-# DASHBOARD_PORT=20128
-
-# Port for the real-time WebSocket live monitoring server.
-# Used by: src/server/ws/liveServer.ts, src/app/api/v1/ws/route.ts
-# Default: 20129
-# LIVE_WS_PORT=20129
-
-# Bind address for the live WebSocket server.
-# Default: 127.0.0.1 (loopback only). Set to 0.0.0.0 to expose on LAN —
-# remember to also configure LIVE_WS_ALLOWED_ORIGINS when doing so.
-# LIVE_WS_HOST=127.0.0.1
-
-# Comma-separated extra origins allowed to open a live WebSocket. The
-# loopback dashboard origins are already permitted by default; use this
-# var when fronting the server with a domain (e.g. https://omni.local).
-# LIVE_WS_ALLOWED_ORIGINS=https://omni.local,https://dashboard.example.com
-
-# Disable the standalone live WebSocket helper used by scripts/start-ws-server.mjs.
-# Used by: scripts/start-ws-server.mjs (CI/embedded harness toggle).
-# OMNIROUTE_DISABLE_LIVE_WS=0
-
-# Enable the real-time dashboard WebSocket server.
-# Used by: src/server/ws/liveServer.ts, scripts/start-ws-server.mjs
-# Default: ON. Set to 0 or false to disable startup of the live WS server.
-# Combine with LIVE_WS_HOST / LIVE_WS_ALLOWED_ORIGINS above when exposing
-# beyond loopback.
-# OMNIROUTE_ENABLE_LIVE_WS=1
-
-# Per-(token,IP) relay rate limit, requests/minute. In-memory, per instance.
-# 0 or negative disables the IP-dimension gate (per-token DB limit still applies).
-# Default: 30
-# Used by: src/app/api/v1/relay/chat/completions/route.ts
-# RELAY_IP_PER_MINUTE=30
-
-# Use Turbopack in local dev. Next 16.2.4 can fail to compile next/font/google
-# through the custom dev runner without this on Windows.
-OMNIROUTE_USE_TURBOPACK=1
-
-# Skip the SQLite integrity health check on startup (faster boot on large DBs).
-# Used by: src/lib/db/core.ts, src/lib/db/healthCheck.ts. Set to 1 to skip.
-# OMNIROUTE_SKIP_DB_HEALTHCHECK=1
-
-# Interval (ms) for the background credential health check scheduler.
-# Default: 300000 (5 minutes). Minimum: 10000 (10 seconds).
-# Used by: open-sse/config/constants.ts, src/lib/credentialHealth/scheduler.ts
-# CREDENTIAL_HEALTH_CHECK_INTERVAL=300000
-
-# TTL (ms) for cached credential health status.
-# Default: 300000 (5 minutes).
-# Used by: open-sse/config/constants.ts, src/lib/credentialHealth/cache.ts
-# CREDENTIAL_HEALTH_CACHE_TTL=300000
-
-# Set to 1 or true to disable background periodic testing of provider connections.
-# Default: false
-# Used by: src/lib/credentialHealth/scheduler.ts
-# OMNIROUTE_DISABLE_CREDENTIAL_HEALTH_CHECK=false
-
-# Set to "true" to emit `[ProxyFetch]` debug logs from the Vercel relay path
-# in open-sse/utils/proxyFetch.ts. Off by default to avoid leaking routing
-# hints in production logs.
-# OMNIROUTE_PROXY_FETCH_DEBUG=true
-
-# Docker production port mappings (docker-compose.prod.yml only).
-# These set the HOST-side published ports. Container ports use PORT/API_PORT.
-# PROD_DASHBOARD_PORT=20130
-# PROD_API_PORT=20131
-
-# Runtime override used by Electron and wrapped environments.
-# OMNIROUTE_PORT takes precedence over PORT when running inside wrappers.
-# Used by: src/lib/runtime/ports.ts — preserves canonical port in Electron.
-# OMNIROUTE_PORT=20128
-
-# Hostname/bind address for the Next.js server.
-# Used by: scripts/dev/run-next.mjs (HOST), Playwright runner (HOSTNAME).
-# Default: 0.0.0.0 (HOST) / 127.0.0.1 (HOSTNAME inside tests).
-#HOST=0.0.0.0
-#HOSTNAME=127.0.0.1
-
-# Environment mode — affects Next.js behavior, logging verbosity, and caching.
-# Values: production | development  |  Default: production
 NODE_ENV=production
 
-# Container runtime — controls startup script behavior (permissions, advice).
-# Values: docker | podman  |  Default: docker
-# Set to "podman" when running under rootless Podman so the entrypoint
-# gives the correct fix instructions (podman unshare chown vs sudo chown).
-CONTAINER_HOST=docker
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 4. SECURITY & AUTHENTICATION
-# ═══════════════════════════════════════════════════════════════════════════════
-
-# Salt for generating unique machine IDs (fingerprint diversification).
-# Used by: src/lib/auth — combined with hardware identifiers for machine-id hash.
-# Default: endpoint-proxy-salt  |  Change per-deployment for isolation.
+# Recommended security and ops variables
+API_KEY_SECRET=endpoint-proxy-api-key-secret
 MACHINE_ID_SALT=endpoint-proxy-salt
-
-# Salt for deriving CLI machine-ID auth tokens (HMAC-SHA256).
-# Used by: src/lib/machineToken.ts — rotates the local CLI auth token without
-#          touching code. Set to a new value to invalidate existing CLI tokens.
-# Default: omniroute-cli-auth-v1
-# OMNIROUTE_CLI_SALT=omniroute-cli-auth-v1
-
-# Set true when running behind HTTPS (reverse proxy with TLS termination).
-# Used by: src/lib/auth — sets the Secure flag on session cookies.
-# Default: false  |  MUST be true in any non-localhost deployment.
+ENABLE_REQUEST_LOGS=false
+OBSERVABILITY_ENABLED=true
 AUTH_COOKIE_SECURE=false
-
-# Require an API key for all /v1/* proxy endpoints.
-# Used by: API middleware — rejects unauthenticated requests to the proxy API.
-# Default: false  |  Set true for multi-user/public deployments.
 REQUIRE_API_KEY=false
 
-# Allow revealing full API key values in the Dashboard UI.
-# Used by: Dashboard providers page — controls show/hide of key values.
-# Default: false  |  Security risk if enabled on shared instances.
-ALLOW_API_KEY_REVEAL=false
-
-# Shared secret for the internal Codex Responses WebSocket bridge.
-# Used by: src/app/api/internal/codex-responses-ws/route.ts — authenticates
-#          bridge requests between the Electron/browser WS relay and OmniRoute.
-# ⚠️  REQUIRED for production — if unset, all WS bridge requests are rejected.
-# Generate: openssl rand -base64 32
-# OMNIROUTE_WS_BRIDGE_SECRET=
-
-# Per-process secret that proves the trusted peer-IP stamp came from OmniRoute's
-# own HTTP server (scripts/dev/peer-stamp.mjs). The custom server stamps the real
-# TCP peer IP as `<token>|<ip>`; the authz middleware trusts the locality only
-# when the token matches. Used by: src/server/authz/policies/management.ts.
-# Auto-generated per boot — leave UNSET in normal use. Only set it to pin a fixed
-# value across processes (e.g. a multi-process setup that must share the stamp).
-# OMNIROUTE_PEER_STAMP_TOKEN=
-
-# Comma-separated API key IDs that skip request logging (GDPR/compliance).
-# Used by: src/lib/compliance/index.ts — suppresses logs for specific keys.
-# NO_LOG_API_KEY_IDS=key_abc123,key_def456
-
-# Fallback per-day request budget applied to API keys whose `rate_limits`
-# column is null. Default (unset/empty/malformed) preserves the legacy
-# 1000/day, 5000/week, 20000/month windows so existing deployments do not
-# silently lose rate limiting on upgrade.
-# Set explicitly to "0" to opt out entirely (unlimited fallback). Any
-# positive integer N enables N/day, 5N/week, 20N/month.
-# Used by: src/shared/utils/apiKeyPolicy.ts — checkRateLimit() fallback.
-# DEFAULT_RATE_LIMIT_PER_DAY=1000
-
-# Maximum request body size in bytes (rejects larger payloads).
-# Used by: src/shared/middleware/bodySizeGuard.ts — prevents oversized uploads.
-# Default: 10485760 (10 MB)
-# MAX_BODY_SIZE_BYTES=10485760
-
-# CORS configuration — controls which origins can call the API.
-# Used by: Next.js middleware — sets Access-Control-Allow-Origin header.
-# Default: * (all origins)  |  Restrict for production security.
-# CORS_ORIGIN=https://your-domain.com
-
-# Allow provider URLs pointing to private/local networks (localhost, 192.168.x.x, etc.).
-# REQUIRED for self-hosted providers: LM Studio, Ollama, vLLM, Llamafile, Triton, etc.
-# Used by: src/shared/network/outboundUrlGuard.ts — disables SSRF guard for provider calls.
-# Default: false (blocked)  |  Set true to enable local providers.
-# OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS=true
-
-# Legacy alias toggling the SSRF guard. Used by: src/shared/network/outboundUrlGuard.ts
-# When unset, OmniRoute uses the per-feature defaults. Set to "false"/"0" to disable.
-# OUTBOUND_SSRF_GUARD_ENABLED=true
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 5. INPUT SANITIZATION & PII PROTECTION (FASE-01)
-# ═══════════════════════════════════════════════════════════════════════════════
-# Multi-layer defense: request-side injection guard + response-side PII sanitizer.
-
-# ── Request-Side: Prompt Injection Guard ──
-# Scans incoming messages for prompt injection patterns before routing.
-# Used by: src/middleware/promptInjectionGuard.ts
-# INPUT_SANITIZER_ENABLED=true
-# INPUT_SANITIZER_MODE=warn    # warn = log only | block = reject request | redact = strip patterns
-
-# Legacy alias for INPUT_SANITIZER_MODE (same effect).
-# INJECTION_GUARD_MODE=warn
-
-# PII detection in incoming requests (emails, phone numbers, SSNs, etc.).
-# Used by: src/middleware/promptInjectionGuard.ts — extends injection guard.
-# PII_REDACTION_ENABLED=false
-
-# Minimum streaming window size for PII detection (bytes). Default: 200.
-# Used by: src/lib/streamingPiiTransform.ts.
-# PII_WINDOW_SIZE=200
-
-# Test bypass: allow setting PII_WINDOW_SIZE below minimum. Default: false.
-# Used by: src/lib/streamingPiiTransform.ts.
-# PII_TEST_BYPASS_MIN_WINDOW=false
-
-# ── Response-Side: PII Sanitizer ──
-# Scans LLM responses for leaked PII before returning to the client.
-# Used by: src/lib/piiSanitizer.ts
-# PII_RESPONSE_SANITIZATION=false
-# PII_RESPONSE_SANITIZATION_MODE=redact  # redact = mask PII | warn = log only | block = drop response
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 6. TOOL & ROUTING POLICIES
-# ═══════════════════════════════════════════════════════════════════════════════
-
-# Tool policy mode — controls which tools LLMs can invoke via function calling.
-# Used by: src/lib/toolPolicy.ts — enforces allowlist/denylist on tool_choice.
-# Values: allowlist | denylist | disabled  |  Default: disabled
-# TOOL_POLICY_MODE=disabled
-
-# Payload manipulation rules JSON file.
-# Used by: open-sse/services/payloadRules.ts — injects/removes upstream payload fields per model/protocol.
-# Default: ./config/payloadRules.json
-# OMNIROUTE_PAYLOAD_RULES_PATH=./config/payloadRules.json
-
-# Reload interval for payloadRules.json mtime checks in milliseconds.
-# Used by: open-sse/services/payloadRules.ts — keeps file-based rules hot-reloadable without restart.
-# Default: 5000  |  Minimum: 1000
-# OMNIROUTE_PAYLOAD_RULES_RELOAD_MS=5000
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 7. URLS & CLOUD SYNC
-# ═══════════════════════════════════════════════════════════════════════════════
-# URLs used for internal sync jobs, OAuth callbacks, and cloud relay.
-
-# Internal base URL — used by server-side sync jobs to call /api/sync/cloud.
-# Used by: src/lib/cloudSync.ts, src/lib/initCloudSync.ts
-# Default: http://localhost:20128
+# Cloud sync variables
+# Must point to this running instance so internal sync jobs can call /api/sync/cloud.
+# Server-side preferred variables:
 BASE_URL=http://localhost:20128
-
-# Cloud relay URL — premium feature for remote config sync.
-# Used by: src/lib/cloudSync.ts — pushes/pulls settings from OmniRoute Cloud.
-CLOUD_URL=
-
-# Timeout for cloud sync HTTP requests in milliseconds.
-# Used by: src/lib/cloudSync.ts — fetchWithTimeout wrapper.
-# Default: 12000 (12 seconds)
-# CLOUD_SYNC_TIMEOUT_MS=12000
-
-# Public-facing base URL — CRITICAL for reverse proxy / OAuth callback setups.
-# Used by: OAuth redirect_uri computation, Dashboard UI links, cloud/model sync.
-# Set to your public URL when behind nginx/Caddy (e.g., https://omniroute.example.com).
-#
-# Dashboard display behavior: when this variable is unset, the dashboard
-# auto-detects the base URL shown in curl examples and CLI tool snippets
-# from window.location.origin (the host the user is browsing). Setting it
-# explicitly is only required when running behind a reverse proxy with a
-# different public hostname, or when OAuth callbacks must point to a
-# canonical URL.
-#
-# Default: http://localhost:20128
+CLOUD_URL=https://9router.com
+# Backward-compatible/public variables:
 NEXT_PUBLIC_BASE_URL=http://localhost:20128
+NEXT_PUBLIC_CLOUD_URL=https://9router.com
 
-# Browser-facing OmniRoute origin for generated assets in API responses.
-# Used by: chatgpt-web image generation cache URLs (/v1/chatgpt-web/image/<id>).
-# Set this when OpenWebUI or another relay reaches OmniRoute by an internal URL
-# but the user's browser must fetch images from a LAN, tunnel, or public origin.
-# Do not include /v1; if included accidentally it will be normalized away.
-# OMNIROUTE_PUBLIC_BASE_URL=http://192.168.0.15:20128
-
-# Max wait time for an async chatgpt-web image to land via the celsius
-# WebSocket, in milliseconds. Default 180000 (3 minutes). Increase during
-# upstream queue-deep windows ("Lots of people are creating images right now").
-# OMNIROUTE_CGPT_WEB_IMAGE_TIMEOUT_MS=180000
-
-# Total in-memory byte budget for the chatgpt-web image cache (used to serve
-# /v1/chatgpt-web/image/<id>), in megabytes. Default 256. Lower this if you
-# run OmniRoute on a memory-constrained host; raise it if image generation
-# is heavy and clients are racing the 30-minute TTL.
-# OMNIROUTE_CGPT_WEB_IMAGE_CACHE_MAX_MB=256
-
-# Public cloud URL — client-side mirror of CLOUD_URL.
-NEXT_PUBLIC_CLOUD_URL=
-
-# Legacy alias — fallback for NEXT_PUBLIC_BASE_URL in sync schedulers.
-# NEXT_PUBLIC_APP_URL=http://localhost:20128
-
-# Public callback URL for asynchronous image/audio jobs (kie.ai, etc.).
-# Used by: open-sse/utils/kieTask.ts — overrides callbackUrlFromBaseUrl().
-# Honor order: KIE_CALLBACK_URL → OMNIROUTE_KIE_CALLBACK_URL → OMNIROUTE_PUBLIC_URL.
-#KIE_CALLBACK_URL=
-#OMNIROUTE_KIE_CALLBACK_URL=
-#OMNIROUTE_PUBLIC_URL=
-
-# Upstream quota endpoints used by the Usage page. Override only for
-# debugging or when routing through a corporate mirror. Used by:
-# open-sse/services/usage.ts.
-#OMNIROUTE_CROF_USAGE_URL=https://crof.ai/usage_api/
-#OMNIROUTE_GEMINI_CLI_USAGE_URL=https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist
-#OMNIROUTE_CODEWHISPERER_BASE_URL=https://codewhisperer.us-east-1.amazonaws.com
-#OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/quota
-#OMNIROUTE_OPENCODE_GO_QUOTA_URL=https://api.z.ai/api/monitor/usage/quota/limit
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 8. OUTBOUND PROXY (Upstream Provider Calls)
-# ═══════════════════════════════════════════════════════════════════════════════
-# Route upstream LLM API calls through an HTTP/SOCKS5 proxy.
-# Useful for corporate egress, geo-routing, or IP masking.
-
-# Enable SOCKS5 proxy support in both server and client components.
-# Used by: open-sse/executors — wraps fetch() calls through the proxy agent.
-ENABLE_SOCKS5_PROXY=true
-NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
-
-# Standard proxy variables (lowercase variants also supported).
+# Optional outbound proxy variables for upstream provider calls
+# Lowercase variants are also supported: http_proxy, https_proxy, all_proxy, no_proxy
 # HTTP_PROXY=http://127.0.0.1:7890
 # HTTPS_PROXY=http://127.0.0.1:7890
 # ALL_PROXY=socks5://127.0.0.1:7890
 # NO_PROXY=localhost,127.0.0.1
 
-# TLS fingerprint spoofing (opt-in) — mimics Chrome 124 TLS handshake via wreq-js.
-# Reduces risk of JA3/JA4 fingerprint-based blocking by providers (e.g., Google).
-# Used by: open-sse/executors — replaces Node.js default TLS fingerprint.
-# ENABLE_TLS_FINGERPRINT=true
-
-# Allow the Claude Turnstile Playwright browser context to ignore HTTPS certificate errors.
-# Only enable for local debugging or trusted MITM/corporate proxy environments.
-# Used by: open-sse/services/claudeTurnstileSolver.ts
-# OMNIROUTE_TURNSTILE_IGNORE_TLS_ERRORS=false
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 9. CLI TOOL INTEGRATION
-# ═══════════════════════════════════════════════════════════════════════════════
-# Control how OmniRoute discovers and launches CLI sidecars (Claude, Codex, etc.).
-# Used by: src/shared/services/cliRuntime.ts
-
-# CLI discovery mode: auto = search PATH | manual = use explicit paths below.
-# CLI_MODE=auto
-
-# Additional PATH entries for finding CLI binaries (colon-separated).
-# CLI_EXTRA_PATHS=/host-cli/bin:/usr/local/bin
-
-# Home directory override for reading CLI config files (~/.claude, etc.).
-# CLI_CONFIG_HOME=/root
-
-# Allow OmniRoute to write CLI config files (token refresh, etc.).
-# CLI_ALLOW_CONFIG_WRITES=true
-
-# Override binary paths for individual CLI tools.
-# CLI_CLAUDE_BIN=claude
-# CLI_CODEX_BIN=codex
-# CLI_DROID_BIN=droid
-# CLI_OPENCLAW_BIN=openclaw
-# CLI_CURSOR_BIN=agent
-# CLI_CLINE_BIN=cline
-# CLI_CONTINUE_BIN=cn
-# CLI_QODER_BIN=qoder
-# CLI_QWEN_BIN=qwen
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 10. INTERNAL AGENT & MCP INTEGRATIONS
-# ═══════════════════════════════════════════════════════════════════════════════
-# Used by MCP server, A2A skills, and CLI sidecars to call the running instance.
-
-# Explicit base URL for MCP/A2A tools to reach OmniRoute (overrides localhost auto-detect).
-# For browser-visible generated image URLs, prefer OMNIROUTE_PUBLIC_BASE_URL above.
-# Used by: open-sse/mcp-server/server.ts, src/lib/a2a/
-# OMNIROUTE_BASE_URL=http://localhost:20128
-
-# API key for internal tool calls (MCP tools, A2A skills).
-# OMNIROUTE_API_KEY=
-
-# API key ID for MCP audit logging.
-# Used by: open-sse/mcp-server/audit.ts — tags audit events with a key identity.
-# OMNIROUTE_API_KEY_ID=
-
-# Legacy alias for OMNIROUTE_API_KEY.
-# ROUTER_API_KEY=
-
-# Enforce scope-based access control on MCP tool calls.
-# Used by: open-sse/mcp-server/server.ts — rejects calls outside allowed scopes.
-# OMNIROUTE_MCP_ENFORCE_SCOPES=false
-
-# Comma-separated scopes granted to this MCP connection.
-# Full list: admin, combos, health, models, routing, budget, metrics, pricing, memory, skills
-# OMNIROUTE_MCP_SCOPES=admin,combos,health
-
-# Compress MCP tool descriptions before serializing the manifest.
-# Used by: open-sse/mcp-server/descriptionCompressor.ts — reduces token spend
-# for clients that read the full tool catalog.
-# Accepted disabling values: 0, false, off. Default: enabled.
-# OMNIROUTE_MCP_COMPRESS_DESCRIPTIONS=1
-
-# Algorithm/profile used when description compression is enabled.
-# Used by: open-sse/mcp-server/descriptionCompressor.ts
-# Set to 0/false/off to skip compression entirely. Default: rtk
-# OMNIROUTE_MCP_DESCRIPTION_COMPRESSION=rtk
-
-# Model catalog sync interval in hours.
-# Used by: src/shared/services/modelSyncScheduler.ts — periodic model refresh.
-# Default: 24
-# MODEL_SYNC_INTERVAL_HOURS=24
-
-# Provider limits sync interval in minutes (rate limit windows, quotas).
-# Used by: src/server-init.ts — polls provider health endpoints.
-# Default: 70
-PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES=70
-
-# Gap (ms) between consecutive OAuth quota fetches in a bulk provider-limits sync.
-# OAuth providers are fetched one at a time with this spacing so a single host
-# never bursts simultaneous usage/refresh requests to the same upstream. Set to 0
-# to opt out (restores fully concurrent fetches). Default: 1500
-PROVIDER_LIMITS_SYNC_SPACING_MS=1500
-
-# Disable all background services (sync, pricing, model refresh).
-# Used by: src/instrumentation-node.ts, src/lib/initCloudSync.ts
-# Useful for: CI builds, test environments, or resource-constrained containers.
-# OMNIROUTE_DISABLE_BACKGROUND_SERVICES=false
-
-# Force runtime background tasks (healthchecks/sync) even under automated test
-# detection. Used by: src/lib/config/runtimeSettings.ts — overrides the test
-# heuristic in instrumentation-node.ts.  Default: unset (tests skip background).
-#OMNIROUTE_ENABLE_RUNTIME_BACKGROUND_TASKS=1
-
-# Background job interval for budget reset checks (ms).  Default: 600000 (10m).
-# Used by: src/lib/jobs/budgetResetJob.ts.  Floor: 10000.
-#OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS=600000
-
-# Reasoning cache cleanup cadence (ms).  Default: 1800000 (30m).  Floor: 60000.
-# Used by: src/lib/jobs/reasoningCacheCleanupJob.ts.
-#OMNIROUTE_REASONING_CACHE_CLEANUP_INTERVAL_MS=1800000
-
-# Spend write batcher cadence (ms) and buffer size before forced flush.
-# Used by: src/lib/spend/batchWriter.ts.  Defaults: 60000 ms / 1000 entries.
-#OMNIROUTE_SPEND_FLUSH_INTERVAL_MS=60000
-#OMNIROUTE_SPEND_MAX_BUFFER_SIZE=1000
-
-# Batch request processor retry, backoff, and concurrency settings.
-# Used by: open-sse/services/batchProcessor.ts. Defaults shown.
-#BATCH_RETRY_DURATION_MS=86400000
-#BATCH_BACKOFF_BASE_MS=5000
-#BATCH_BACKOFF_MAX_MS=3600000
-#BATCH_MAX_CONCURRENT=1
-
-# Config hot-reload polling interval (ms).  Default: 5000.
-# Used by: src/lib/config/hotReload.ts.  Lower than 1000ms is rejected.
-#OMNIROUTE_CONFIG_HOT_RELOAD_MS=5000
-
-# Override the migrations directory used by src/lib/db/migrationRunner.ts.
-# Default: <repo>/src/lib/db/migrations.
-#OMNIROUTE_MIGRATIONS_DIR=
-
-# Trust user-managed RTK project filter rules without strict signature checks.
-# Used by: open-sse/services/compression/engines/rtk/filterLoader.ts.  Default: 0.
-#OMNIROUTE_RTK_TRUST_PROJECT_FILTERS=0
-
-# Skip the postinstall native-runtime warm-up (useful in CI / headless installs). Default: 0.
-# Used by: scripts/postinstall.mjs.
-#OMNIROUTE_SKIP_POSTINSTALL=0
-
-# Skip the DB healthcheck entirely on startup (useful for short-lived tasks / tests).
-# Used by: src/lib/db/core.ts, src/lib/db/healthCheck.ts.  Set to 1 to disable.  Default: 0.
-#OMNIROUTE_SKIP_DB_HEALTHCHECK=0
-
-# Force a DB healthcheck regardless of cadence.  Default: 0.
-# Used by: src/lib/db/core.ts::shouldRunDbHealthCheck().
-#OMNIROUTE_FORCE_DB_HEALTHCHECK=0
-
-# DB healthcheck cadence override (ms).  Default: 21600000 (6h).
-# Used by: src/lib/db/core.ts::getDbHealthCheckIntervalMs().
-#OMNIROUTE_DB_HEALTHCHECK_INTERVAL_MS=21600000
-
-# Skip the Redis-backed auth cache used by API key lookups (forces DB reads).
-# Used by: src/lib/db/apiKeys.ts.  Set to 1 to disable.  Default: enabled.
-#OMNIROUTE_DISABLE_REDIS_AUTH_CACHE=0
-
-# Flag set by bootstrap script after initial setup is complete.
-# Used by: src/app/(dashboard)/dashboard/page.tsx — shows setup wizard vs. dashboard.
-# OMNIROUTE_BOOTSTRAPPED=false
-
-# Allow request body to override the Antigravity project field.
-# Used by: open-sse/executors/antigravity.ts — escape hatch for multi-project setups.
-# OMNIROUTE_ALLOW_BODY_PROJECT_OVERRIDE=0
-
-# Adjust how Antigravity advertises remaining credits.  Used by:
-# open-sse/services/antigravityCredits.ts — accepts forced override strings.
-# Default: empty (use upstream-reported credits).
-#ANTIGRAVITY_CREDITS=
-
-# Override the path to the Antigravity CLI (agy) token file read by the
-# "auto-detect local login" import. Used by:
-# src/app/api/providers/agy-auth/apply-local/route.ts — for non-standard installs.
-# Default: ~/.gemini/antigravity-cli/antigravity-oauth-token
-#AGY_TOKEN_FILE=
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 11. OAUTH PROVIDER CREDENTIALS
-# ═══════════════════════════════════════════════════════════════════════════════
-# Built-in default credentials for localhost development.
-# For remote/VPS deployments, register your own at each provider's developer console.
-# The bootstrap-env script auto-populates these in .env if missing.
-# Can also be overridden via data/provider-credentials.json where supported.
-
-# ── Claude Code (Anthropic) ──
-CLAUDE_OAUTH_CLIENT_ID=9d1c250a-e61b-44d9-88ed-5944d1962f5e
-# Custom redirect URI override for Claude OAuth callback.
-# CLAUDE_CODE_REDIRECT_URI=https://platform.claude.com/oauth/code/callback
-
-# ── Codex / OpenAI ──
-CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
-
-# Milliseconds to wait between consecutive Codex token refreshes.
-# Used by: open-sse/services/refreshSerializer.ts. Default: 0 (no spacing).
-# CODEX_REFRESH_SPACING_MS=0
-
-# ── Trae (ByteDance) ──
-# Trae stream idle timeout (ms). Default: 300000 (5 min).
-# Used by: open-sse/executors/trae.ts.
-# TRAE_STREAM_TIMEOUT_MS=300000
-
-# Trae OAuth token override. Used by: open-sse/executors/trae.ts.
-# TRAE_TOKEN=
-
-# ── The Old LLM (theoldllm) ──
-# Playwright navigation timeout (ms) for the browser-backed token capture.
-# Used by: open-sse/executors/theoldllm.ts. Default: 30000 (30s).
-# THEOLDLLM_NAV_TIMEOUT_MS=30000
-
-# ── Gemini / Gemini CLI / Antigravity / Windsurf (all Google-based) ──
-# These providers ship public OAuth client_id/secret values (or Firebase Web
-# keys) embedded in their public CLIs/binaries. Defaults are baked into the
-# code via open-sse/utils/publicCreds.ts — leave the env vars unset to use
-# them. Only set these if you registered your own OAuth app and want to use
-# your own credentials instead. See docs/security/PUBLIC_CREDS.md for context.
-#
-# GEMINI_OAUTH_CLIENT_ID=
-# GEMINI_OAUTH_CLIENT_SECRET=
-# GEMINI_CLI_OAUTH_CLIENT_ID=
-# GEMINI_CLI_OAUTH_CLIENT_SECRET=
-# ANTIGRAVITY_OAUTH_CLIENT_ID=
-# ANTIGRAVITY_OAUTH_CLIENT_SECRET=
-# WINDSURF_FIREBASE_API_KEY=
-
-# ── Qwen (Alibaba) ──
-QWEN_OAUTH_CLIENT_ID=f0304373b74a44d2b584a3fb70ca9e56
-
-# ── Kimi Coding (Moonshot) ──
-KIMI_CODING_OAUTH_CLIENT_ID=17e5f671-d194-4dfb-9706-5516cb48c098
-
-# ── GitHub Copilot ──
-GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
-
-# ── GitLab Duo ──
-# Register an OAuth app at: https://gitlab.com/-/profile/applications
-# Set redirect URI to: http://localhost:20128/callback (or your NEXT_PUBLIC_BASE_URL + /callback)
-# Required scopes: api, read_user, openid, profile, email
-# GITLAB_DUO_OAUTH_CLIENT_ID=***
-# GITLAB_DUO_OAUTH_CLIENT_SECRET=***  # optional — PKCE flow does not require a secret
-#
-# Self-managed GitLab Duo instance overrides.
-# Used by: src/lib/oauth/gitlab.ts and src/lib/oauth/constants/oauth.ts —
-# fall back to these when the _DUO_ variants above are unset.
-#GITLAB_DUO_BASE_URL=https://gitlab.com
-#GITLAB_BASE_URL=https://gitlab.com
-#GITLAB_OAUTH_CLIENT_ID=
-#GITLAB_OAUTH_CLIENT_SECRET=
-
-# ── Qoder ──
-# Public OAuth client secret embedded in the Qoder CLI binary. Required only
-# when QODER_OAUTH_AUTHORIZE_URL / TOKEN_URL / USERINFO_URL / CLIENT_ID are
-# also set (see QODER_CONFIG.enabled in src/lib/oauth/constants/oauth.ts).
-# Extract the value from the public Qoder CLI binary if you intend to use it.
-# QODER_OAUTH_CLIENT_SECRET=
-
-# ── Qoder Browser OAuth (experimental) ──
-# OmniRoute only enables the browser OAuth flow when ALL 5 variables below are set:
-#   - QODER_OAUTH_AUTHORIZE_URL
-#   - QODER_OAUTH_TOKEN_URL
-#   - QODER_OAUTH_USERINFO_URL
-#   - QODER_OAUTH_CLIENT_ID
-#   - QODER_OAUTH_CLIENT_SECRET
-#
-# Redirect URI to register in the Qoder OAuth app:
-#   - Localhost dev with PORT=20128: http://localhost:20128/callback
-#   - LAN access (example):        http://192.168.0.15:20128/callback
-#   - Public domain (recommended): https://omniroute.example.com/callback
-#
-# Behind reverse proxy / public domain, also set NEXT_PUBLIC_BASE_URL to the same public origin.
-# If these values are not available, prefer QODER_PERSONAL_ACCESS_TOKEN below.
-# QODER_OAUTH_AUTHORIZE_URL=
-# QODER_OAUTH_TOKEN_URL=
-# QODER_OAUTH_USERINFO_URL=
-# QODER_OAUTH_CLIENT_ID=
-# QODER_OAUTH_CLIENT_SECRET=
-
-# ── Qoder Personal Access Token (direct API key fallback) ──
-# Used by: open-sse/executors/qoder.ts — bypasses OAuth when set.
-# QODER_PERSONAL_ACCESS_TOKEN=
-# QODER_CLI_WORKSPACE=
-# OMNIROUTE_QODER_WORKSPACE=
-
-# ── Blackbox Web validated-token override (issue #2252) ──
-# Used by: open-sse/executors/blackbox-web.ts. Blackbox `/api/chat` rejects
-# requests whose `validated` field doesn't match the frontend `tk` token,
-# returning HTTP 403 even with a valid session cookie + active subscription.
-# Set this to the `tk` value exported from app.blackbox.ai's Next.js bundle
-# to bypass the random-UUID fallback. Leave empty to keep the legacy behavior.
-# BLACKBOX_WEB_VALIDATED_TOKEN=
-
-# ── Vision Bridge OpenAI-compatible endpoint override (issue #2232) ──
-# Used by: src/lib/guardrails/visionBridgeHelpers.ts. By default the
-# vision-bridge guardrail sends non-Anthropic image-description calls to
-# `https://api.openai.com/v1`, which fails with 401 if your operator doesn't
-# have an OpenAI key or wants to use a different vision model
-# (e.g., `google/gemini-2.0-flash` via the Gemini OpenAI-compat endpoint, or
-# any model registered in OmniRoute via the self-loop endpoint).
-#
-# Set these two env vars to point the bridge at any OpenAI-compatible URL:
-#   - VISION_BRIDGE_BASE_URL=http://localhost:20128/v1   (OmniRoute self-loop)
-#   - VISION_BRIDGE_BASE_URL=https://generativelanguage.googleapis.com/v1beta/openai
-#   - VISION_BRIDGE_BASE_URL=https://openrouter.ai/api/v1
-# Anthropic models (anthropic/*) keep their dedicated path and are unaffected.
-# VISION_BRIDGE_BASE_URL=
-# VISION_BRIDGE_API_KEY=
-
-# ─────────────────────────────────────────────────────────────────────────────
-# ⚠️  GOOGLE OAUTH (Antigravity, Gemini CLI) & OTHER PROVIDERS — REMOTE SERVERS
-# ─────────────────────────────────────────────────────────────────────────────
-# The default Client IDs above ONLY work when OmniRoute runs on localhost.
-# For remote/VPS hosting (including Docker containers on remote servers):
-#   1. By default, the browser will attempt OAuth redirects back to localhost, which will fail.
-#   2. Set NEXT_PUBLIC_BASE_URL=https://your-domain.com to fix the redirect URI.
-#   3. You MUST create your own OAuth App in each provider's developer console (Google Cloud, etc.)
-#      and set the Authorized redirect URI to your domain (e.g., https://your-domain.com/callback).
-#   4. Replace the _OAUTH_CLIENT_ID and _SECRET values above with your own credentials.
-# ─────────────────────────────────────────────────────────────────────────────
-
-# ── OAuth sidecar/CLI bridge (internal) ──
-# Used by: src/lib/oauth/config/index.ts — internal CLI↔OmniRoute auth bridge.
-# OMNIROUTE_SERVER=http://localhost:20128
-# OMNIROUTE_TOKEN=
-# OMNIROUTE_USER_ID=cli
-# CLI_TOKEN=        # legacy alias for OMNIROUTE_TOKEN
-# CLI_USER_ID=      # legacy alias for OMNIROUTE_USER_ID
-# SERVER_URL=       # legacy alias for OMNIROUTE_SERVER
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 12. PROVIDER USER-AGENT OVERRIDES
-# ═══════════════════════════════════════════════════════════════════════════════
-# Customize the User-Agent header sent to each upstream provider.
-# Format: {PROVIDER_ID}_USER_AGENT=custom-value
-# Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
-# Update these when providers release new CLI versions to avoid blocks.
-
-CLAUDE_USER_AGENT="claude-cli/2.1.158 (external, cli)"
-
-# Disable the deterministic tool-name cloak applied on both Anthropic-bound paths
-# (executors/base.ts native OAuth + executors/cliproxyapi.ts CLIProxyAPI) ���
-# third-party-harness tool names are aliased to
-# Claude Code canonical or PascalCase forms so Anthropic does not refuse the
-# stream with a misleading 400 out-of-extra-usage placeholder. Set to true to
-# forward the original names verbatim (debugging only).
-# CLAUDE_DISABLE_TOOL_NAME_CLOAK=false
-CODEX_USER_AGENT="codex-cli/0.132.0 (Windows 10.0.26200; x64)"
-GITHUB_USER_AGENT="GitHubCopilotChat/0.45.1"
-ANTIGRAVITY_USER_AGENT="antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0"
-KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
-# Optional override for the Kiro social device-code OAuth clientId. Kiro's
-# device endpoint accepts any non-empty string and behaves like a User-Agent
-# rather than a secret. Only override if AWS ever starts enforcing this field.
-# Used by: src/lib/oauth/constants/oauth.ts (KIRO_CONFIG.socialClientId).
-# KIRO_OAUTH_CLIENT_ID=kiro-cli
-QODER_USER_AGENT="Qoder-Cli"
-QWEN_USER_AGENT="QwenCode/0.15.11 (linux; x64)"
-CURSOR_USER_AGENT="Cursor/3.4"
-GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
-
-# Override Codex client version sent in headers independently of the
-# CODEX_USER_AGENT string. Used by: open-sse/config/codexClient.ts.
-# CODEX_CLIENT_VERSION=0.132.0
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 13. CLI FINGERPRINT COMPATIBILITY (Anti-Detection)
-# ═══════════════════════════════════════════════════════════════════════════════
-# When enabled, OmniRoute reorders HTTP headers and JSON body fields to match
-# the exact signature of official CLI tools, reducing account flagging risk.
-# Your proxy IP is preserved — you get both stealth AND IP masking.
-# Used by: open-sse/config/cliFingerprints.ts, open-sse/executors/base.ts
-
-# Enable per-provider:
-# CLI_COMPAT_CODEX=1
-# CLI_COMPAT_CLAUDE=1
-# CLI_COMPAT_GITHUB=1
-# CLI_COMPAT_ANTIGRAVITY=1
-# CLI_COMPAT_CURSOR=1
-# CLI_COMPAT_KIMI_CODING=1
-# CLI_COMPAT_KILOCODE=1
-# CLI_COMPAT_CLINE=1
-# CLI_COMPAT_QWEN=1
-
-# Or enable for all providers at once:
-# CLI_COMPAT_ALL=1
-
-# ── Kimi Coding CLI identity overrides ──
-# Used by: src/lib/oauth/providers/kimi-coding.ts — sent in OAuth + API headers.
-# Leave unset to use the captured defaults baked into the OmniRoute build.
-#KIMI_CLI_VERSION=1.36.0
-#KIMI_CODING_DEVICE_ID=
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 14. API KEY PROVIDERS
-# ═══════════════════════════════════════════════════════════════════════════════
-# API keys for direct-authentication providers.
-# Preferred setup: Dashboard → Providers → Add API Key.
-# Setting here is an alternative for Docker/headless deployments.
-
-# Static API keys for direct-authentication providers wired through the runtime.
-# OmniRoute loads provider credentials from the encrypted database or
-# data/provider-credentials.json. The variables below are documented escape
-# hatches that are referenced in code today.
-# DEEPSEEK_API_KEY=
-# NVIDIA_API_KEY=
-
-# Windsurf / Devin CLI direct API key.
-# Used by: open-sse/executors/devin-cli.ts — bypasses OAuth when set.
-# WINDSURF_API_KEY=
-
-# Embedding Providers (optional — used by /v1/embeddings)
-# OpenAI/Mistral/Together/Fireworks/NVIDIA configured via Dashboard → Providers
-# also work for embeddings.
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 15. TIMEOUT SETTINGS
-# ═══════════════════════════════════════════════════════════════════════════════
-# All timeout values are in milliseconds.
-# Used by: src/shared/utils/runtimeTimeouts.ts — centralized timeout resolution.
-#
-# Hierarchy: REQUEST_TIMEOUT_MS acts as a global override.
-# If set, it becomes the default for FETCH_TIMEOUT_MS and STREAM_IDLE_TIMEOUT_MS.
-# The fine-grained variables below override their respective defaults only when set.
-
-# ── Global shortcut ──
-# REQUEST_TIMEOUT_MS=600000          # Overrides both fetch and stream idle defaults
-
-# ── Upstream fetch (provider calls) ──
-# FETCH_TIMEOUT_MS=600000            # Total request timeout (default: 600000 = 10 min)
-#                                     # Also drives anthropic-compatible-cc-* X-Stainless-Timeout.
-# FETCH_HEADERS_TIMEOUT_MS=600000    # Time to receive response headers
-# FETCH_BODY_TIMEOUT_MS=600000       # Time to receive full response body
-# FETCH_CONNECT_TIMEOUT_MS=30000     # TCP connection establishment (default: 30s)
-# FETCH_KEEPALIVE_TIMEOUT_MS=4000    # Keep-alive socket idle timeout (default: 4s)
-
-# Default timeout (ms) for src/shared/utils/fetchTimeout.ts. Acts as the
-# fallback when FETCH_TIMEOUT_MS is unset. Default: 120000 (2 min).
-# OMNIROUTE_DEFAULT_FETCH_TIMEOUT_MS=120000
-
-# ── ChatGPT TLS sidecar (Firefox-fingerprinted client) ──
-# Used by: open-sse/services/chatgptTlsClient.ts — wire-level timeout for
-# the bogdanfinn/tls-client koffi binding and the JS-side grace window
-# layered on top of it when the native library is wedged.
-# OMNIROUTE_CHATGPT_TLS_TIMEOUT_MS=60000
-# OMNIROUTE_CHATGPT_TLS_GRACE_MS=10000
-
-# ── Claude TLS sidecar (Chromium-fingerprinted client) ──
-# Used by: open-sse/services/claudeTlsClient.ts — wire-level timeout for
-# the bogdanfinn/tls-client koffi binding and the JS-side grace window
-# layered on top of it when the native library is wedged.
-# OMNIROUTE_CLAUDE_TLS_TIMEOUT_MS=60000
-# OMNIROUTE_CLAUDE_TLS_GRACE_MS=10000
-
-# ── Perplexity TLS sidecar (Firefox-fingerprinted client) ──
-# Used by: open-sse/services/perplexityTlsClient.ts — wire-level timeout for
-# the bogdanfinn/tls-client koffi binding and the JS-side grace window
-# layered on top of it when the native library is wedged.
-# OMNIROUTE_PPLX_TLS_TIMEOUT_MS=30000
-# OMNIROUTE_PPLX_TLS_GRACE_MS=10000
-
-# ── Grok web TLS sidecar (Chrome-fingerprinted client) ──
-# Used by: open-sse/services/grokTlsClient.ts — wire-level timeout for the
-# bogdanfinn/tls-client koffi binding and the JS-side grace window layered on
-# top of it when the native library is wedged.
-# OMNIROUTE_GROK_TLS_TIMEOUT_MS=60000
-# OMNIROUTE_GROK_TLS_GRACE_MS=10000
-
-# ── Circuit breaker thresholds and reset windows ──
-# Used by: open-sse/config/constants.ts → src/lib/resilience/settings.ts.
-# Defaults match historical PROVIDER_PROFILES values (post-scaling for
-# 500+ connections). Lower the threshold to react faster, raise it to
-# tolerate more transient failures before short-circuiting.
-# OMNIROUTE_CIRCUIT_BREAKER_OAUTH_THRESHOLD=8
-# OMNIROUTE_CIRCUIT_BREAKER_OAUTH_RESET_MS=60000
-# OMNIROUTE_CIRCUIT_BREAKER_API_KEY_THRESHOLD=12
-# OMNIROUTE_CIRCUIT_BREAKER_API_KEY_RESET_MS=30000
-# OMNIROUTE_CIRCUIT_BREAKER_LOCAL_THRESHOLD=2
-# OMNIROUTE_CIRCUIT_BREAKER_LOCAL_RESET_MS=15000
-
-# ── Stream idle detection ──
-# STREAM_IDLE_TIMEOUT_MS=600000      # Max silence between SSE chunks (default: 600000)
-#                                     # Extended-thinking models rarely pause >90s.
-
-# ── TLS client (wreq-js fingerprint proxy) ──
-# TLS_CLIENT_TIMEOUT_MS=600000       # Inherits from FETCH_TIMEOUT_MS by default
-
-# ── API Bridge (/v1 proxy server) ──
-# API_BRIDGE_PROXY_TIMEOUT_MS=600000             # Proxy hop timeout (default: 10min)
-# API_BRIDGE_SERVER_REQUEST_TIMEOUT_MS=600000     # Overall server request timeout (default: 10min)
-# API_BRIDGE_SERVER_HEADERS_TIMEOUT_MS=60000      # Time to send response headers
-# API_BRIDGE_SERVER_KEEPALIVE_TIMEOUT_MS=5000     # Keep-alive idle timeout
-# API_BRIDGE_SERVER_SOCKET_TIMEOUT_MS=0           # Raw socket timeout (0 = disabled)
-
-# ── Graceful shutdown ──
-# Time to wait for in-flight requests before force-exiting on SIGTERM/SIGINT.
-# Used by: src/lib/gracefulShutdown.ts
-# Default: 30000 (30 seconds)
-# SHUTDOWN_TIMEOUT_MS=30000
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 16. LOGGING
-# ═══════════════════════════════════════════════════════════════════════════════
-# Used by: src/lib/logEnv.ts, src/lib/logRotation.ts, src/shared/utils/logger.ts
-
-# Application log level — controls console and file log verbosity.
-# Values: debug | info | warn | error  |  Default: info
-# APP_LOG_LEVEL=info
-
-# Log output format.
-# Values: text | json  |  Default: text
-# APP_LOG_FORMAT=text
-
-# Write logs to file in addition to stdout.
-# Default: true  |  Set false to disable file logging.
-APP_LOG_TO_FILE=true
-
-# Path to the application log file.
-# Default: logs/application/app.log (relative to project root / DATA_DIR)
-# APP_LOG_FILE_PATH=logs/application/app.log
-
-# Maximum single log file size before rotation.
-# Accepts: plain bytes or suffixed (50M, 1G, 512K). Default: 50M
-# APP_LOG_MAX_FILE_SIZE=50M
-
-# Days to keep rotated application log files before auto-deletion.
-# Default: 7
-# APP_LOG_RETENTION_DAYS=7
-
-# Maximum number of rotated log file backups to keep.
-# Default: 20
-# APP_LOG_MAX_FILES=20
-
-# How often OmniRoute checks whether the active log file has exceeded
-# APP_LOG_MAX_FILE_SIZE and triggers a rotation. Set lower for very verbose
-# services to prevent log files from growing large between checks.
-# Accepts milliseconds. Default: 60000 (1 minute)
-# APP_LOG_ROTATION_CHECK_INTERVAL_MS=60000
-
-# Days to keep request/call log entries in the database before auto-cleanup.
-# Default: 7
-# CALL_LOG_RETENTION_DAYS=7
-
-# Maximum call log entries stored in-memory buffer.
-# Default: 10000
-# CALL_LOG_MAX_ENTRIES=10000
-
-# Maximum rows in the call_logs SQLite table before oldest entries are pruned.
-# Default: 100000
-# CALL_LOGS_TABLE_MAX_ROWS=100000
-
-# Whether call log pipeline capture stores stream chunks when enabled in settings.
-# Only applies when call_log_pipeline_enabled=true.
-# Default: true
-# CALL_LOG_PIPELINE_CAPTURE_STREAM_CHUNKS=true
-
-# Maximum call log artifact size for pipeline captures, in KB.
-# Only applies when call_log_pipeline_enabled=true.
-# Default: 512
-# CALL_LOG_PIPELINE_MAX_SIZE_KB=512
-
-# Call log payload truncation limits — controls how much of request/response
-# bodies is retained in the database.
-# Used by: open-sse/handlers/chatCore.ts — cloneBoundedChatLogPayload()
-# CHAT_LOG_TEXT_LIMIT=65536                  # Max string length before truncation (default: 64 KB)
-# CHAT_LOG_ARRAY_TAIL_ITEMS=24               # Number of array items retained from tail (default: 24)
-# CHAT_LOG_MAX_DEPTH=6                       # Max nesting depth before truncation (default: 6)
-# CHAT_LOG_MAX_OBJECT_KEYS=80                # Max object keys retained (default: 80, 0 = no limit)
-
-# Maximum rows in the proxy_logs SQLite table.
-# Default: 100000
-# PROXY_LOGS_TABLE_MAX_ROWS=100000
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 17. MEMORY OPTIMIZATION (Low-RAM / Docker)
-# ═══════════════════════════════════════════════════════════════════════════════
-
-# Node.js V8 heap limit in MB, passed to the server via --max-old-space-size.
-# Used by the standalone launcher (Docker CMD) and `omniroute serve`.
-# Clamped to [64, 16384]. Default: 512 (safe for a 1 GB / 1 core VPS). Size it to
-# roughly half the box's RAM, leaving the rest for native memory (better-sqlite3,
-# buffers — ~300 MB) and the OS:
-#   1 GB RAM  → 512   (default)
-#   2 GB RAM  → 1024
-#   4 GB RAM  → 2048
-# In a memory-capped container, set this EXPLICITLY: Node reads the HOST's RAM,
-# not the cgroup limit, so leaving it to a RAM heuristic can oversize the heap and
-# get the container OOM-killed. (#2939)
-# OMNIROUTE_MEMORY_MB=512
-
-# Heap-pressure shed threshold (MB) — chatCore returns 503 when V8 heapUsed exceeds
-# it, to avoid hard OOM under concurrent large-context load.
-# LEAVE UNSET: it now AUTO-CALIBRATES to 85% of the actual V8 heap ceiling, so it
-# tracks OMNIROUTE_MEMORY_MB above and never sits below the ~260 MB runtime baseline
-# (a fixed 200 here used to reject every request). Used by: open-sse/utils/heapPressure.ts.
-# Override only to hand-tune for a known workload.
-# HEAP_PRESSURE_THRESHOLD_MB=
-
-# ── CLI helpers (bin/cli/) ──
-# Override UI language for CLI output. Accepts BCP-47 locale (e.g. en, pt-BR).
-# Falls back to LC_ALL / LC_MESSAGES / LANG / en if unset.
-# OMNIROUTE_LANG=en
-
-# Show server logs inline when running in supervised mode (omniroute serve).
-# Set to "1" to forward server stdout/stderr to the terminal.
-# Equivalent to the --log flag on `omniroute serve`.
-# OMNIROUTE_SHOW_LOG=1
-
-# Bearer token injected as x-omniroute-cli-token header for machine-auth (task 8.12).
-# Auto-generated on first run if machine-id is available; set manually to override.
-# OMNIROUTE_CLI_TOKEN=
-
-# Per-attempt HTTP timeout for CLI → server calls (milliseconds). Default: 30000.
-# OMNIROUTE_HTTP_TIMEOUT_MS=30000
-
-# Set to 1 to print retry/backoff details to stderr during CLI commands.
-# OMNIROUTE_VERBOSE=0
-
-# Custom directory for CLI plugin discovery (omniroute-cmd-* packages).
-# Default: ~/.omniroute/plugins/  Override in dev/CI to point at a local plugin tree.
-# OMNIROUTE_PLUGIN_PATH=
-
-# Allow plugins to request the 'exec' permission (spawn child processes from the
-# plugin worker sandbox). Disabled by default; set to 1 to enable (local operator only).
-# OMNIROUTE_PLUGINS_ALLOW_EXEC=0
-
-# ── Prompt cache (system prompt deduplication) ──
-# Used by: open-sse/services — caches identical system prompts across requests.
-# PROMPT_CACHE_MAX_SIZE=50              # Max cached entries (default: 50)
-# PROMPT_CACHE_MAX_BYTES=2097152        # Max total cache size in bytes (default: 2 MB)
-# PROMPT_CACHE_TTL_MS=300000            # Cache entry TTL (default: 5 minutes)
-
-# ── Semantic cache (deterministic response dedup, temperature=0) ──
-# Used by: open-sse/services — caches identical temperature=0 responses.
-# SEMANTIC_CACHE_MAX_SIZE=100            # Max cached entries (default: 100)
-# SEMANTIC_CACHE_MAX_BYTES=4194304       # Max total cache size in bytes (default: 4 MB)
-# SEMANTIC_CACHE_TTL_MS=1800000          # Cache entry TTL (default: 30 minutes)
-
-# ── In-memory log buffers ──
-# Maximum recent stream events kept in memory for the Dashboard live view.
-# STREAM_HISTORY_MAX=50
-
-# ── Context length default ──
-# Global fallback max context length for models without explicit config.
-# Used by: open-sse/services/contextManager.ts
-# CONTEXT_LENGTH_DEFAULT=128000
-
-# ── Usage token buffer ──
-# Extra token headroom reserved when tracking usage quotas (prevents over-limit).
-# Used by: open-sse/utils/usageTracking.ts
-# USAGE_TOKEN_BUFFER=100
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 18. PRICING SYNC
-# ═══════════════════════════════════════════════════════════════════════════════
-# Automatic model pricing synchronization from external sources.
-# Used by: src/lib/pricingSync.ts
-
-# Enable periodic pricing data sync.  Default: false (opt-in only).
-# PRICING_SYNC_ENABLED=false
-
-# Sync interval in seconds.  Default: 86400 (24 hours).
-# PRICING_SYNC_INTERVAL=86400
-
-# Comma-separated data sources.  Default: litellm
-# PRICING_SYNC_SOURCES=litellm
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 19. MODEL SYNC (Dev)
-# ═══════════════════════════════════════════════════════════════════════════════
-# Development-time model catalog sync interval in seconds.
-# Used by: src/lib/modelsDevSync.ts
-# Default: 86400 (24 hours)
-# MODELS_DEV_SYNC_INTERVAL=86400
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 20. PROVIDER-SPECIFIC SETTINGS
-# ═══════════════════════════════════════════════════════════════════════════════
-
-# ── OpenRouter ──
-# OpenRouter model catalog cache TTL in ms.
-# Used by: src/lib/catalog/openrouterCatalog.ts
-# Default: 86400000 (24 hours)
-# OPENROUTER_CATALOG_TTL_MS=86400000
-
-# ── NanoBanana (Image Generation) ──
-# Polling config for async image generation jobs.
-# Used by: open-sse/handlers/imageGeneration.ts
-# NANOBANANA_POLL_TIMEOUT_MS=120000    # Max wait for job completion (default: 120s)
-# NANOBANANA_POLL_INTERVAL_MS=2500     # Poll frequency (default: 2.5s)
-
-# ── AWS Bedrock (Kiro / Audio) ──
-# Region used to construct AWS Bedrock endpoints. Used by:
-# src/lib/providers/validation.ts and open-sse/handlers/audioSpeech.ts.
-# AWS_REGION takes precedence over AWS_DEFAULT_REGION when both are set.
-# AWS_REGION=us-east-1
-# AWS_DEFAULT_REGION=us-east-1
-
-# ── Cloudflare Workers AI ──
-# Account ID override for Cloudflare Workers AI executor.
-# Used by: open-sse/executors/cloudflare-ai.ts
-# CLOUDFLARE_ACCOUNT_ID=
-
-# ── Cloudflare Tunnel (cloudflared) ──
-# Custom path to cloudflared binary for tunnel management.
-# Used by: src/lib/cloudflaredTunnel.ts
-# CLOUDFLARED_BIN=/usr/local/bin/cloudflared
-
-# ── Search cache ──
-# TTL for search API response caching (Perplexity, Brave, etc.).
-# Used by: open-sse/services/searchCache.ts
-# Default: 300000 (5 minutes)
-# SEARCH_CACHE_TTL_MS=300000
-
-# ── OpenAI-compatible multi-connection ──
-# Allow multiple simultaneous connections per OpenAI-compatible provider node.
-# Used by: src/app/api/providers/route.ts
-# ALLOW_MULTI_CONNECTIONS_PER_COMPAT_NODE=false
-
-# ── CC-compatible provider (experimental) ──
-# Enable the Claude Code compatible provider endpoint.
-# This is only for third-party relays that accept Claude Code clients exclusively.
-# OmniRoute rewrites requests to pass those relays' Claude Code client validation.
-# If you only want to use Claude Code CLI, or you are not sure what these relays are,
-# keep this disabled and add a regular Anthropic-compatible provider instead.
-# Used by: src/shared/utils/featureFlags.ts
-# ENABLE_CC_COMPATIBLE_PROVIDER=false
-
-# ── 9router embedded service ──
-# Override the host/port where the embedded 9router instance listens.
-# Rarely needed — defaults match the bootstrap config (127.0.0.1:20130).
-# Used by: open-sse/executors/ninerouter.ts
-# NINEROUTER_HOST=127.0.0.1
-# NINEROUTER_PORT=20130
-
-# ── Embedded service WebSocket proxy ──
-# Standalone WebSocket proxy that tunnels WS connections to embedded services.
-# Binds to loopback by default. Only change EMBED_WS_PROXY_HOST if you know
-# what you are doing — exposing this to non-loopback bypasses local-only policy.
-# Used by: src/lib/services/embedWsProxy.ts
-# EMBED_WS_PROXY_HOST=127.0.0.1
-# EMBED_WS_PROXY_PORT=20131
-
-# ── CLIProxyAPI bridge (legacy) ──
-# Connection settings for external CLIProxyAPI instances.
-# Used by: open-sse/executors/cliproxyapi.ts
-# CLIPROXYAPI_HOST=127.0.0.1
-# CLIPROXYAPI_PORT=5544
-# CLIPROXYAPI_CONFIG_DIR=~/.cli-proxy-api
-
-# ── Local hostnames (Docker networking) ──
-# Comma-separated additional hostnames treated as "local" for provider routing.
-# Used by: open-sse/config/providerRegistry.ts — allows Docker service names.
-# LOCAL_HOSTNAMES=omlx,mlx-audio
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 21. PROXY HEALTH
-# ═══════════════════════════════════════════════════════════════════════════════
-# Fine-tune proxy health checking behavior.
-# Used by: src/lib/proxyHealth.ts
-
-# Timeout for fast-fail health checks (ms).  Default: 2000
-# PROXY_FAST_FAIL_TIMEOUT_MS=2000
-
-# Health check result cache TTL (ms).  Default: 30000 (30s)
-# PROXY_HEALTH_CACHE_TTL_MS=30000
-
-# Rate limit maximum wait time before failing a request (ms).  Default: 120000 (2 min)
-# Used by: open-sse/services/rateLimitManager.ts
-# RATE_LIMIT_MAX_WAIT_MS=120000
-
-# Force the auto-enable rate limit safety net on/off regardless of the persisted
-# Dashboard setting. Used by: open-sse/services/rateLimitManager.ts.
-# Accepted values: true|1|on (force on), false|0|off (force off), unset (use Dashboard).
-# RATE_LIMIT_AUTO_ENABLE=
-
-# Stagger interval (ms) between provider token healthchecks at startup.
-# Used by: src/lib/tokenHealthCheck.ts.  Default: 3000.
-# HEALTHCHECK_STAGGER_MS=3000
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 22. DEBUGGING
-# ═══════════════════════════════════════════════════════════════════════════════
-# These variables enable verbose debugging output. NEVER enable in production.
-
-# Cursor executor verbose debug (decoded SSE chunks, etc.).
-# CURSOR_STREAM_DEBUG is kept as a backward-compatible alias.
-# Used by: open-sse/executors/cursor.ts
-# CURSOR_DEBUG=1
-
-# Enable verbose trace logging for OmniRoute internals.
-# Used by: open-sse/handlers/chatCore.ts.
-# OMNIRROUTE_TRACE=true
-
-# Standard DEBUG flag (same effect as OMNIRROUTE_TRACE).
-# DEBUG=true
-# CURSOR_STREAM_DEBUG=1
-
-# When CURSOR_DEBUG=1, also append raw decoded chunks to this file path.
-# CURSOR_DUMP_FILE=/tmp/cursor-stream.log
-
-# Cursor stream idle timeout (ms). Default: 300000 (5 min).
-# Used by: open-sse/executors/cursor.ts.
-# CURSOR_STREAM_TIMEOUT_MS=300000
-
-# Cursor tool-commit directive toggle. Default-on: when a request declares
-# tools, a directive is prepended so composer-2.5 reliably issues tool calls
-# instead of narrating intent. Set to 0 to disable.
-# Used by: open-sse/executors/cursor.ts.
-# CURSOR_TOOL_DIRECTIVE=1
-
-# Per-image fetch timeout (ms) for remote image_url vision input. Default: 15000.
-# Used by: open-sse/utils/cursorImages.ts.
-# CURSOR_IMAGE_FETCH_TIMEOUT_MS=15000
-
-# Cursor state DB path override (for cursor version detection).
-# Used by: open-sse/utils/cursorVersionDetector.ts. Default: probed automatically.
-# CURSOR_STATE_DB_PATH=
-
-# Direct Cursor bearer token used by scripts/ad-hoc/cursor-tap.cjs (developer tooling).
-# CURSOR_TOKEN=
-
-# Log Responses API SSE-to-JSON translation details.
-# DEBUG_RESPONSES_SSE_TO_JSON=true
-
-# Log request shape (content-type + content-length) for large chat payloads.
-# Used by: src/app/api/v1/chat/completions/route.ts. Set to "0" to silence.
-# Default: enabled.
-# OMNIROUTE_LOG_REQUEST_SHAPE=1
-
-# Write raw (untruncated) request/response JSON in call log artifacts.
-# When enabled, serializeArtifactForStorage skips size-based truncation.
-# Also enabled automatically when APP_LOG_LEVEL=debug.
-# WARNING: produces large files — use only for temporary debugging.
-# CHAT_DEBUG_FILE=true
-
-# Enable E2E test mode — relaxes auth and enables test harness hooks.
-# NEXT_PUBLIC_OMNIROUTE_E2E_MODE=true
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 23. GITHUB INTEGRATION (Issue Reporting)
-# ═══════════════════════════════════════════════════════════════════════════════
-# Allow users to report issues directly from the Dashboard to GitHub.
-# Used by: src/app/api/v1/issues/report/route.ts
-
-# GitHub repository in owner/repo format.
-# GITHUB_ISSUES_REPO=owner/repo
-
-# GitHub Personal Access Token with issues:write scope.
-# GITHUB_ISSUES_TOKEN=ghp_xxxx
-
-# Generic GitHub access token consumed by issue triage / agent helpers.
-# Used by: src/app/api/v1/issues/* and src/lib/cloudAgent/* — falls back to
-# GITHUB_ISSUES_TOKEN when unset.
-# GITHUB_TOKEN=
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 24. PROVIDER QUOTAS, TUNNELS & SANDBOXED SKILLS
-# ═══════════════════════════════════════════════════════════════════════════════
-# Provider quota endpoints, network tunnels (Tailscale, Ngrok, MITM debug
-# proxy), 1Proxy egress pool, skills sandbox runtime, and miscellaneous CLI
-# binaries referenced by the executor layer or the dashboard runtime.
-
-# ── Alibaba (Bailian) coding plan quota ──
-# Host/full URL override used by: open-sse/services/bailianQuotaFetcher.ts.
-# When unset the fetcher uses the production Alibaba endpoints.
-# ALIBABA_CODING_PLAN_HOST=
-# ALIBABA_CODING_PLAN_QUOTA_URL=
-
-# ── Context window tuning ──
-# Tokens reserved for completion output when computing prompt budgets.
-# Used by: open-sse/services/contextManager.ts. Default: 1024.
-# CONTEXT_RESERVE_TOKENS=1024
-
-# ── Model alias rewriting (legacy compatibility) ──
-# Toggle the legacy model-alias compatibility layer used by older clients.
-# Used by: open-sse/services/model.ts.  Default: enabled.
-# MODEL_ALIAS_COMPAT_ENABLED=true
-
-# ── Devin CLI binary path ──
-# Used by: open-sse/executors/devin-cli.ts. Default: looked up via PATH.
-# CLI_DEVIN_BIN=devin
-
-# ── Command Code (custom CLI) callback ──
-# Local port used for OAuth-style callbacks from the Command Code CLI helper.
-# Used by: src/app/api/providers/command-code/auth/shared.ts.
-# COMMAND_CODE_CALLBACK_PORT=
-
-# ── MITM debug proxy (development only) ──
-# Used by: src/mitm/server.cjs — captures upstream traffic for inspection.
-# MITM_LOCAL_PORT=443
-# MITM_DISABLE_TLS_VERIFY=0
-
-# ── 1Proxy egress pool ──
-# Used by: src/lib/oneproxySync.ts — fetches proxy nodes from the OmniRoute
-# CrofAI 1Proxy service. Disable, override URL, or tune the import quality.
-# ONEPROXY_ENABLED=true
-# ONEPROXY_API_URL=https://1proxy-api.aitradepulse.com
-# ONEPROXY_MAX_PROXIES=500
-# ONEPROXY_MIN_QUALITY_THRESHOLD=50
-
-# ── Free Proxy Pool (1proxy source) ──
-# Used by: src/lib/freeProxyProviders/oneproxy.ts
-# Set FREE_PROXY_1PROXY_ENABLED=false to disable this source.
-# FREE_PROXY_1PROXY_ENABLED=true
-# FREE_PROXY_1PROXY_API_URL=https://1proxy-api.aitradepulse.com/api/v1/proxies/advanced
-# FREE_PROXY_1PROXY_MAX=500
-# FREE_PROXY_1PROXY_MIN_QUALITY=50
-
-# ── Free Proxy Pool (Proxifly source) ──
-# Used by: src/lib/freeProxyProviders/proxifly.ts
-# Enabled by default; set to false to disable.
-# FREE_PROXY_PROXIFLY_ENABLED=true
-# FREE_PROXY_PROXIFLY_QUANTITY=100
-# FREE_PROXY_PROXIFLY_ANONYMITY=elite
-
-# ── Free Proxy Pool (IPLocate source) ──
-# Used by: src/lib/freeProxyProviders/iplocate.ts
-# Opt-in only; must set FREE_PROXY_IPLOCATE_ENABLED=true to activate.
-# FREE_PROXY_IPLOCATE_ENABLED=false
-# FREE_PROXY_IPLOCATE_BASE_URL=https://raw.githubusercontent.com/iplocate/free-proxy-list/main/protocols
-
-# ── Vercel Relay ──
-# Used by: src/app/api/settings/proxy/vercel-deploy/route.ts
-# Hides the "Deploy Relay" button when set to false.
-# NEXT_PUBLIC_VERCEL_RELAY_ENABLED=true
-# VERCEL_API_BASE=https://api.vercel.com
-# Default project name pre-filled in the Vercel Relay deploy modal.
-# NEXT_PUBLIC_VERCEL_RELAY_DEFAULT_PROJECT=omniroute-relay
-
-# ── Tailscale tunnel binaries ──
-# Optional explicit paths to tailscale/tailscaled binaries used by the
-# dashboard's tunnel manager. Used by: src/lib/tailscaleTunnel.ts.
-# TAILSCALE_BIN=/usr/local/bin/tailscale
-# TAILSCALED_BIN=/usr/local/bin/tailscaled
-
-# ── Ngrok tunnel ──
-# Used by: src/lib/ngrokTunnel.ts — authenticates outbound tunnels.
-# NGROK_AUTHTOKEN=
-
-# ── Database backups ──
-# Used by: src/lib/db/backup.ts.
-# DB_BACKUP_MAX_FILES=20
-# DB_BACKUP_RETENTION_DAYS=0
-
-# ── TLS sidecar override ──
-# Used by: open-sse/services/chatgptTlsClient.ts tests. Production deployments
-# should leave this unset; the sidecar is auto-managed.
-# OMNIROUTE_TLS_PROXY_URL=
-
-# ── Skills sandbox (experimental) ──
-# Used by: src/lib/skills/builtins.ts. All values support comma lists where
-# noted in the source.
-# SKILLS_MAX_FILE_BYTES=1048576
-# SKILLS_MAX_HTTP_RESPONSE_BYTES=256000
-# SKILLS_MAX_SANDBOX_OUTPUT_CHARS=100000
-# SKILLS_SANDBOX_TIMEOUT_MS=10000
-# SKILLS_SANDBOX_NETWORK_ENABLED=0
-# SKILLS_ALLOWED_SANDBOX_IMAGES=
-
-# ═══════════════════════════════════════════════════════════════════════════════
-# 25. TEST & E2E
-# ═══════════════════════════════════════════════════════════════════════════════
-# Used by scripts/dev/run-next-playwright.mjs, scripts/dev/smoke-electron-packaged.mjs,
-# scripts/dev/run-ecosystem-tests.mjs and scripts/build/uninstall.mjs.
-# Production deployments should leave every value below unset.
-
-# E2E bootstrap mode for the Playwright runner. Accepted: auth | fresh | reuse.
-# Default (when unset): auth.
-# OMNIROUTE_E2E_BOOTSTRAP_MODE=auth
-
-# Admin password injected into the Playwright test environment.
-# Falls back to INITIAL_PASSWORD when unset.
-# OMNIROUTE_E2E_PASSWORD=
-
-# Disable the local healthcheck poll during Playwright runs (default: true).
-# OMNIROUTE_DISABLE_LOCAL_HEALTHCHECK=true
-
-# Disable the OAuth token healthcheck loop during tests (default: true).
-# OMNIROUTE_DISABLE_TOKEN_HEALTHCHECK=true
-
-# Exclude specific providers from the PROACTIVE token-refresh sweep (comma-separated,
-# case-insensitive). Targeted alternative to OMNIROUTE_DISABLE_TOKEN_HEALTHCHECK: keeps
-# rotating-cascade providers (Codex/OpenAI share one Auth0 family) on the reactive 401
-# path only, while short-TTL providers like Kimi-coding keep being refreshed proactively.
-# OMNIROUTE_HEALTHCHECK_SKIP_PROVIDERS=codex,openai
-
-# Silence healthcheck noise in Playwright stdout (default: true).
-# OMNIROUTE_HIDE_HEALTHCHECK_LOGS=true
-
-# Skip the Next.js production build before Playwright starts (CI optimization).
-# OMNIROUTE_PLAYWRIGHT_SKIP_BUILD=0
-
-# Skip the OmniRoute uninstall hook (used by CI to keep node_modules intact).
-# OMNIROUTE_SKIP_UNINSTALL_HOOK=0
-
-# Ecosystem/protocol test orchestrators wait this long (ms) for the server to
-# become healthy. Default: 180000.
-# ECOSYSTEM_SERVER_WAIT_MS=180000
-
-# Docs translation pipeline (used by scripts/i18n/run-translation.mjs).
-# OpenAI-compatible base URL, e.g. https://cloud.omniroute.online/v1
-# OMNIROUTE_TRANSLATION_API_URL=
-# Bearer token for the translation backend (NEVER commit a real key here).
-# OMNIROUTE_TRANSLATION_API_KEY=
-# Model id, e.g. gpt-4o-mini or cx/gpt-5.4-mini.
-# OMNIROUTE_TRANSLATION_MODEL=gpt-4o-mini
-# Per-request timeout in milliseconds (default 60000).
-# OMNIROUTE_TRANSLATION_TIMEOUT_MS=60000
-# Number of parallel translation requests (default 4).
-# OMNIROUTE_TRANSLATION_CONCURRENCY=4
-
-# ─── Cloud Sync hardening (v3.8.6) ──────────────────────────────────────────
-# Shared secret used to verify the HMAC-SHA256 of the Cloud sync response body
-# (the Cloud endpoint must sign each response with the same secret and place
-# the hex digest in the X-Cloud-Sig header). When unset, v3.8.6 logs a warning
-# but accepts unsigned responses for back-compat. v3.9 will make this required.
-# OMNIROUTE_CLOUD_SYNC_SECRET=
-#
-# Set to "true" to allow the Cloud Sync endpoint to overwrite local OAuth
-# tokens (accessToken / refreshToken / providerSpecificData). Default OFF —
-# only non-credential metadata is synced. See docs/security/SOCKET_DEV_FINDINGS.md §5.
-# OMNIROUTE_CLOUD_SYNC_SECRETS=false
-
-# ─── Zed import legacy compat (v3.8.6) ────���─────────────────────────────────
-# Set to "true" to fall back to the v3.8.5 one-step "import everything from
-# the keychain" behaviour. Default OFF — the new 2-step confirmation flow
-# requires `confirmedAccounts` in the request body. See SOCKET_DEV_FINDINGS.md §2.
-# OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=false
-
-# ─── Build profile (build-time only) ────────────────────────────────────────
-# Set to "minimal" before `npm run build` to physically remove four optional
-# privileged modules (MITM cert install, Zed keychain import, Cloud Sync,
-# 9router installer) from the standalone bundle. The resulting artifact is
-# intended to be published as `omniroute-secure`. See SECURITY.md.
-# OMNIROUTE_BUILD_PROFILE=full
-
-# Electron smoke harness (used by scripts/dev/smoke-electron-packaged.mjs).
-# ELECTRON_SMOKE_URL=http://127.0.0.1:20128/login
-# ELECTRON_SMOKE_TIMEOUT_MS=45000
-# ELECTRON_SMOKE_SETTLE_MS=2000
-# ELECTRON_SMOKE_APP_EXECUTABLE=
-# ELECTRON_SMOKE_DATA_DIR=
-# ELECTRON_SMOKE_KEEP_DATA=0
-# ELECTRON_SMOKE_STREAM_LOGS=0
-
-# Playground Studio
-# Default model used by the improve-prompt route (optional; falls back to model in request body).
-PLAYGROUND_IMPROVE_PROMPT_DEFAULT_MODEL=
-# Maximum number of parallel compare columns in the Compare tab.
-PLAYGROUND_COMPARE_MAX_COLUMNS=4
-# Memory engine (plan 21)
-# MEMORY_EMBEDDING_CACHE_TTL_MS=300000          # default 5 min
-# MEMORY_EMBEDDING_CACHE_MAX=1000               # default 1000 entries
-# MEMORY_TRANSFORMERS_MODEL=Xenova/all-MiniLM-L6-v2
-# MEMORY_STATIC_MODEL=minishlab/potion-base-8M  # HF repo id (download once)
-# MEMORY_STATIC_CACHE_DIR=                      # default <DATA_DIR>/embeddings
-# MEMORY_VEC_TOP_K=20                           # default top-K for vector search
-# MEMORY_RRF_K=60                               # RRF k constant (sqlite-vec hybrid recipe)
-# HF_HUB_ENDPOINT=https://huggingface.co        # override Hugging Face Hub base URL for static potion downloads
-# AgentBridge + Traffic Inspector (Group A)
-
-# AgentBridge
-AGENTBRIDGE_UPSTREAM_CA_CERT=
+# Optional SearXNG endpoint for the built-in unauthenticated web-search provider.
+# SEARXNG_URL=http://searxng:8080/search
 
-# Inspector
-INSPECTOR_BUFFER_SIZE=1000
-INSPECTOR_HTTP_PROXY_PORT=8080
-INSPECTOR_HTTP_PROXY_AUTOSTART=false
-INSPECTOR_TLS_INTERCEPT=false
-INSPECTOR_SYSTEM_PROXY_GUARD_MINUTES=30
-INSPECTOR_MAX_BODY_KB=1024
-INSPECTOR_MASK_SECRETS=true
-INSPECTOR_LLM_HOSTS_EXTRA=
-INSPECTOR_INTERNAL_INGEST_TOKEN=
-# Quota Sharing (Group B — planos 16+22)
-QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
-# QUOTA_STORE_REDIS_URL=               # ex.: redis://localhost:6379 (apenas quando driver=redis)
-# QUOTA_SATURATION_THRESHOLD=0.5       # 0..1; >= threshold ativa modo strict (sem empréstimo)
-# QUOTA_SOFT_DEPRIORITIZE_FACTOR=0.7   # 0..1; multiplicador do score quando soft policy ativa
-# QUOTA_CONSUMPTION_RETENTION_DAYS=14  # GC de buckets quota_consumption.updated_at antigos
+# Currently unused by application runtime (kept as reference)
+# INSTANCE_NAME=9router

.gitignore

@@ -1,58 +1,31 @@
 # See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
 
-# project-specific directories
-.omnivscodeagent/
-omnirouteCloud/
-omnirouteSite/
-_cache/
-_ideia/
-_mono_repo/
-_references/
-_tasks/
-.agents/**
-.claude/**
-.gemini/**
-.config/**
-.data/**
-.logs/**
-.tests/**
-.coverage/**
-coverage/
-.dist/**
-.next/**
-.build/**
-.out/**
-
-
-# Memory Bank and Cursor rules (local-only AI agent context)
-memory-bank/
-.cursor/rules/core.mdc
-.cursor/rules/memory-bank.mdc
-
-# Claude Code local state — runtime files only; shared commands at .claude/commands/ are tracked
-.claude/scheduled_tasks.lock
-.claude/scheduled_tasks/
-.claude/sessions/
-.claude/state.json
-.claude/settings.local.json
-
-# Root-level underscore-prefixed directories (private/draft — never commit)
-/_*/
-
-# Draft features documentation (internal only)
-docs/new-features/
-
 # dependencies
-node_modules/
-*.map
-.DS_Store
-
-# Obsidian sync plugin — committed for community distribution
-!obsidian-plugin/
-obsidian-plugin/node_modules/
+/node_modules
+/.pnp
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/versions
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/.next-cli-build/
+/out/
+cli/.build-home/
+product
+# production
+/build
+.idea/
 
-# Serena AI assistant config (local-only tool, not project code)
-.serena/
+# misc
+.DS_Store
+*.pem
 
 # debug
 npm-debug.log*
@@ -63,9 +36,6 @@ yarn-error.log*
 # env files (can opt-in for committing if needed)
 .env*
 !.env.example
-# Provider API keys (never commit)
-*.api-key
-.nvidia-api-key
 
 # vercel
 .vercel
@@ -74,128 +44,45 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 
-# data and logs
+.bin/*
 data/
-.data/
 logs/*
-test_output.log
-
-# analysis directories (generated, not tracked)
-.analysis/
-antigravity-manager-analysis/
-.sisyphus/
-.plans/
-
-# open-sse tests
+source/*
+.cursor/*
+docs/*
+!docs/ARCHITECTURE.md
+test/*
 open-sse/test/*
+RM.vn.md
+RM.md
+cursor/*
+PUBLIC.md
+Thanks.md
+PUBLIC.en.md
+PR/*
+package-lock.json
 
-# Ignore vscode AI rules
-.github/instructions/codacy.instructions.md
-
-# Playwright
-.playwright-mcp/
-test-results/
-playwright-report/
-blob-report/
-cloud/
-.tmp/
 
-# Security Analysis (standalone project with own git)
-security-analysis/
-
-# Deploy workflow (contains sensitive VPS credentials)
-clipr/
-app.log
-*.tgz
-.gh-discussions.json
-deploy.sh
-docker-compose.minimal.yml
-
-
-# Backup directories
-app.__qa_backup/
-.app-build-backup-*/
-backup/
-
-# Build intermediates (.build/) and shippable standalone (dist/).
-# These are fully reproducible from source; never committed.
-# Layer 1: Next.js now writes to .build/next (was .next); assembled bundle → dist/
-# (Previously /app/ was the standalone output; renamed to /dist/ in Layer 1.)
-/.build/
-/dist/
-/.next/
-
-# Electron
-electron/dist-electron/
-electron/node_modules/
-icon.iconset/
-
-# VS Code Extension (independent Git repo)
-vscode-extension/
-
-# SQLite residual files
-*.sqlite-shm
-*.sqlite-wal
-*.sqlite-journal
-
-# IDEA
-.idea/
-
-# Local OpenCode agent config
-.config/
-
-# Empty/dangling files
-typescript
-
-# Gemini Antigravity agent data
-.gemini/
-
-# Superpowers plans/specs (internal tooling, not project code)
-docs/superpowers/
-
-# GitNexus local index
-.gitnexus
-.worktrees
-bin/omniroute.mjs
-
-# Consistent with .dockerignore / .npmignore
-.omc/
-audit-report.json
-bun.lock
-
-# Private environment variables for .http-client
-http-client.private.env.json
-
-# Note: _ideia/ (feature-triage drafts) is fully covered by the /_*/ rule above
-# and kept as a separate local-only git repo. Never committed to OmniRoute.
+#Ignore vscode AI rules
+.github/instructions/codacy.instructions.md
+README1.md
+deploy*.sh
+ecosystem.config.*
 
-# i18n audit artifact (generated by scripts/i18n/audit-dashboard-pages.mjs)
-scripts/i18n/_audit.json
-scripts/i18n/_pending-keys.json
+scripts/agSniffer/*
+gitbooks/*
+gitbook/README.md
 
-# Private workflow / skill / command implementations
-# These contain proprietary multi-phase logic and should not be committed
-.agents/workflows/implement-features-ag.md
-.agents/workflows/port-upstream-features-ag.md
-.agents/workflows/port-upstream-issues-ag.md
-.agents/skills/implement-features/
-.claude/commands/implement-features-cc.md
-.claude/commands/port-upstream-features-cc.md
-.claude/commands/port-upstream-issues-cc.md
-.claude/worktrees/
-.codegraph/
+# Refactor backup reference (do not bundle/lint)
+open-sse.old/
+.graphifyignore
+graphify-out/*
 
-# Fumadocs generated source
-.source/
-
-# AI agent local settings and configs
-.agents/
-.antigravitycli/
+# Local-only working dirs (notes, vendored repos, scripts, skills)
 .claude/
-
-# PR Reviews and local feedback files
-pr_reviews*.json
-
-#hidden local data directories (never commit)
-.local-data/
-.data-dev/
+.docs/
+.repo/
+.script/
+.codegraph/
+.PR/
+.next-analyze/*

.npmignore

@@ -3,101 +3,29 @@ data/
 **/data/
 **/db.json
 
-# VS Code extension test runtime (large binary, not needed in npm package)
-app/vscode-extension/
-**/data/
-**/db.json
-
-# Source code (pre-built app/ is published instead)
+# Development
 src/
-open-sse/
 docs/
-tests/
-cloud/
-images/
-logs/
+test/
+agents/
 scripts/
+worker/
+shared-sse/
+copilot-api/
+CLIProxyAPI/
 
-# Config/dev files
+# Config files
 *.md
 !README.md
 .gitignore
-.git/
-.github/
-.husky/
-.vscode/
-.agents/
 .env*
-app/.env
-app/.env*
+jsconfig.json
 eslint.config.mjs
-prettier.config.mjs
 postcss.config.mjs
 next.config.mjs
 tsconfig.json
-tsconfig.typecheck-core.json
-tsconfig.typecheck-noimplicit-core.json
-playwright.config.ts
-vitest.config.ts
-next-env.d.ts
-llm.txt
-
-# Docker
-docker-compose*.yml
-Dockerfile
-.dockerignore
-
-# Misc
-AGENTS.md
-bun.lock
-
-# Build artifacts (pre-built goes inside app/)
-/.next/
-/node_modules/
-
-# Ignore large binary files and other build directories
-*.tgz
-*.AppImage
-*.deb
-*.rpm
-electron/
-app/electron/
-app/vscode-extension/
-
-# Subprojects
-clipr/
-omnirouteCloud/
-omnirouteSite/
-vscode-extension/
 
-# Root-level underscore-prefixed directories (private/draft — never publish)
-/_*/
-app/_*/
-app/coverage/
-app/logs/
-app/tests/
+# Build artifacts that shouldn't be published
+.next/cache/
+.next/standalone/data/
 
-# Consistent with .gitignore and .dockerignore
-.DS_Store
-.idea/
-.config/
-.data/
-.omnivscodeagent/
-.omc/
-*.sqlite-*
-*.tsbuildinfo
-security-analysis/
-.analysis/
-antigravity-manager-analysis/
-.sisyphus/
-.plans/
-app.__qa_backup/
-.app-build-backup-*/
-.gitnexus
-.worktrees
-.next-playwright/
-test-results/
-playwright-report/
-blob-report/
-coverage/
-@omniroute/

CLAUDE.md

@@ -2,452 +2,90 @@
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
-## Quick Start
+## What this is
 
-```bash
-npm install                    # Install deps (auto-generates .env from .env.example)
-npm run dev                    # Dev server at http://localhost:20128
-npm run build                  # Production build (Next.js 16 standalone)
-npm run lint                   # ESLint (0 errors expected; warnings are pre-existing)
-npm run typecheck:core         # TypeScript check (should be clean)
-npm run typecheck:noimplicit:core  # Strict check (no implicit any)
-npm run test:coverage          # Unit tests + coverage gate (60/60/60/60 — statements/lines/functions/branches)
-npm run check                  # lint + test combined
-npm run check:cycles           # Detect circular dependencies
-```
-
-### Running Tests
-
-```bash
-# Single test file (Node.js native test runner — most tests)
-node --import tsx/esm --test tests/unit/your-file.test.ts
-
-# Vitest (MCP server, autoCombo, cache)
-npm run test:vitest
-
-# All suites
-npm run test:all
-```
-
-For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep architecture, see `AGENTS.md`.
-
----
-
-## Project at a Glance
-
-**OmniRoute** — unified AI proxy/router. One endpoint, 160+ LLM providers, auto-fallback.
-
-| Layer         | Location                | Purpose                                                            |
-| ------------- | ----------------------- | ------------------------------------------------------------------ |
-| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                  |
-| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                         |
-| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                    |
-| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                           |
-| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                   |
-| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                           |
-| Database      | `src/lib/db/`           | SQLite domain modules (45+ files, 55 migrations)                   |
-| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                          |
-| MCP Server    | `open-sse/mcp-server/`  | 43 tools (30 base + 3 memory + 4 skills + 6 notion), 3 transports, ~13 scopes |
-| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                        |
-| Skills        | `src/lib/skills/`       | Extensible skill framework                                         |
-| Memory        | `src/lib/memory/`       | Persistent conversational memory                                   |
-
-Monorepo: `src/` (Next.js 16 app), `open-sse/` (streaming engine workspace), `electron/` (desktop app), `tests/`, `bin/` (CLI entry point).
-
----
-
-## Request Pipeline
-
-```
-Client → /v1/chat/completions (Next.js route)
-  → CORS → Zod validation → auth? → policy check → prompt injection guard
-  → handleChatCore() [open-sse/handlers/chatCore.ts]
-    → cache check → rate limit → combo routing?
-      → resolveComboTargets() → handleSingleModel() per target
-    → translateRequest() → getExecutor() → executor.execute()
-      → fetch() upstream → retry w/ backoff
-    → response translation → SSE stream or JSON
-    → If Responses API: responsesTransformer.ts TransformStream
-```
-
-API routes follow a consistent pattern: `Route → CORS preflight → Zod body validation → Optional auth (extractApiKey/isValidApiKey) → API key policy enforcement → Handler delegation (open-sse)`. No global Next.js middleware — interception is route-specific.
-
-**Combo routing** (`open-sse/services/combo.ts`): 14 strategies (priority, weighted, fill-first, round-robin, P2C, random, least-used, cost-optimized, reset-aware, strict-random, auto, lkgp, context-optimized, context-relay). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. See `docs/routing/AUTO-COMBO.md` for the 9-factor Auto-Combo scoring and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
-
----
-
-## Resilience Runtime State
-
-OmniRoute has three related but distinct temporary-failure mechanisms. Keep their
-scope separate when debugging routing behavior. See the
-[3-layer resilience diagram](./docs/diagrams/exported/resilience-3layers.svg)
-(source: [docs/diagrams/resilience-3layers.mmd](./docs/diagrams/resilience-3layers.mmd))
-for an at-a-glance map.
-
-### Provider Circuit Breaker
-
-**Scope**: whole provider, e.g. `glm`, `openai`, `anthropic`.
-
-**Purpose**: stop sending traffic to a provider that is repeatedly failing at the
-upstream/service level, so one unhealthy provider does not slow down every request.
-
-**Implementation**:
-
-- Core class: `src/shared/utils/circuitBreaker.ts`
-- Chat gate/execution wiring: `src/sse/handlers/chatHelpers.ts`, `src/sse/handlers/chat.ts`
-- Runtime status API: `src/app/api/monitoring/health/route.ts`
-- Shared wrappers: `open-sse/services/accountFallback.ts`
-- Persisted state table: `domain_circuit_breakers`
-
-**States**:
+9Router (`9router-app`) — a local AI routing gateway + Next.js dashboard. It exposes one OpenAI-compatible endpoint (`/v1/*`) and routes traffic across 40+ upstream providers with format translation, model-combo fallback, multi-account fallback, OAuth/API-key credential management, token refresh, quota/usage tracking, and optional cloud sync.
 
-- `CLOSED`: normal traffic is allowed.
-- `OPEN`: provider is temporarily blocked; callers get a provider-circuit-open response
-  or combo routing skips to another target.
-- `HALF_OPEN`: reset timeout has elapsed; allow a probe request. Success closes the
-  breaker, failure opens it again.
+Two published artifacts live in this one repo:
+- The **dashboard + gateway** (root `package.json`, `9router-app`) — the Next.js server that does the actual routing.
+- The **CLI launcher** (`cli/`, published to npm as `9router`) — a separate package that installs/starts the server and manages the tray. It has its own `package.json`, version, and build.
 
-**Defaults** (`open-sse/config/constants.ts`):
+The code lives in `src/` (Next.js app + dashboard/compat APIs), `open-sse/` (the provider-agnostic routing/translation engine), `cli/` (the launcher package), and `tests/`.
 
-- OAuth providers: threshold `3`, reset timeout `60s`.
-- API-key providers: threshold `5`, reset timeout `30s`.
-- Local providers: threshold `2`, reset timeout `15s`.
+## Commands
 
-Only provider-level failure statuses should trip the provider breaker:
-
-```ts
-(408, 500, 502, 503, 504);
-```
-
-Do not trip the whole-provider breaker for normal account/key/model errors like most
-`401`, `403`, or `429` cases. Those usually belong to connection cooldown or model
-lockout. A generic API-key provider `403` should be recoverable unless it is classified
-as a terminal provider/account error.
-
-The breaker uses lazy recovery, not a background timer. When `OPEN` expires, reads such
-as `getStatus()`, `canExecute()`, and `getRetryAfterMs()` refresh the state to
-`HALF_OPEN`, so dashboards and combo candidate builders do not keep excluding an
-expired provider forever.
-
-### Connection Cooldown
-
-**Scope**: one provider connection/account/key.
-
-**Purpose**: temporarily skip one bad key/account while allowing other connections for
-the same provider to continue serving requests.
-
-**Implementation**:
-
-- Write/update path: `src/sse/services/auth.ts::markAccountUnavailable()`
-- Account selection/filtering: `src/sse/services/auth.ts::getProviderCredentials...`
-- Cooldown calculation: `open-sse/services/accountFallback.ts::checkFallbackError()`
-- Settings: `src/lib/resilience/settings.ts`
-
-Important fields on provider connections:
-
-```ts
-rateLimitedUntil;
-testStatus: "unavailable";
-lastError;
-lastErrorType;
-errorCode;
-backoffLevel;
-```
-
-During account selection, a connection is skipped while:
-
-```ts
-new Date(rateLimitedUntil).getTime() > Date.now();
+Dashboard/gateway (run from repo root):
+```bash
+cp .env.example .env
+npm install
+PORT=20128 NEXT_PUBLIC_BASE_URL=http://localhost:20128 npm run dev   # dev (webpack, port 20127 by default via next dev)
+npm run build && PORT=20128 HOSTNAME=0.0.0.0 npm run start           # production
 ```
+- Bun variants: `npm run dev:bun` / `build:bun` / `start:bun`.
+- Default runtime port is **20128** (dashboard at `/dashboard`, API at `/v1`).
+- Lint: `npx eslint .` (config `eslint.config.mjs`, extends `eslint-config-next`).
 
-Cooldowns are also lazy: when `rateLimitedUntil` is in the past, the connection becomes
-eligible again. On successful use, `clearAccountError()` clears `testStatus`,
-`rateLimitedUntil`, error fields, and `backoffLevel`.
-
-Default connection cooldown behavior:
-
-- OAuth base cooldown: `5s`.
-- API-key base cooldown: `3s`.
-- API-key `429` should prefer upstream retry hints (`Retry-After`, reset headers, or
-  parseable reset text) when available.
-- Repeated recoverable failures use exponential backoff:
-
-```ts
-baseCooldownMs * 2 ** failureIndex;
+CLI package (`cli/`):
+```bash
+npm run cli:pack       # build + npm pack from root
+cd cli && npm run dev  # nodemon watch
 ```
 
-The anti-thundering-herd guard prevents concurrent failures on the same connection from
-repeatedly extending the cooldown or double-incrementing `backoffLevel`.
-
-Terminal states are not cooldowns. `banned`, `expired`, and `credits_exhausted` are
-intended to stay unavailable until credentials/settings change or an operator resets
-them. Do not overwrite terminal states with transient cooldown state.
-
-### Model Lockout
-
-**Scope**: provider + connection + model.
-
-**Purpose**: avoid disabling a whole connection when only one model is unavailable or
-quota-limited for that connection.
-
-Examples:
-
-- Per-model quota providers returning `429`.
-- Local providers returning `404` for one missing model.
-- Provider-specific mode/model permission failures such as selected Grok modes.
-
-Model lockout lives in `open-sse/services/accountFallback.ts` and lets the same
-connection continue serving other models.
-
-### Debugging Guidance
-
-- If all keys for a provider are skipped, inspect both provider breaker state and each
-  connection's `rateLimitedUntil`/`testStatus`.
-- If a provider appears permanently excluded after the reset window, check whether code
-  is reading raw `state` instead of using `getStatus()`/`canExecute()`.
-- If one provider key fails but others should work, prefer connection cooldown over
-  provider breaker.
-- If only one model fails, prefer model lockout over connection cooldown.
-- If a state should self-recover, it should have a future timestamp/reset timeout and a
-  read path that refreshes expired state. Permanent statuses require manual credential
-  or config changes.
-
----
-
-## Key Conventions
-
-### Code Style
-
-- **2 spaces**, semicolons, double quotes, 100 char width, es5 trailing commas (enforced by lint-staged via Prettier)
-- **Imports**: external → internal (`@/`, `@omniroute/open-sse`) → relative
-- **Naming**: files=camelCase/kebab, components=PascalCase, constants=UPPER_SNAKE
-- **ESLint**: `no-eval`, `no-implied-eval`, `no-new-func` = error everywhere; `no-explicit-any` = warn in `open-sse/` and `tests/`
-- **TypeScript**: `strict: false`, target ES2022, module esnext, resolution bundler. Prefer explicit types.
-
-### Database
-
-- **Always** go through `src/lib/db/` domain modules — **never** write raw SQL in routes or handlers
-- **Never** add logic to `src/lib/localDb.ts` (re-export layer only)
-- **Never** barrel-import from `localDb.ts` — import specific `db/` modules instead
-- DB singleton: `getDbInstance()` from `src/lib/db/core.ts` (WAL journaling)
-- Migrations: `src/lib/db/migrations/` — versioned SQL files, idempotent, run in transactions
-
-### Error Handling
-
-- try/catch with specific error types, log with pino context
-- Never swallow errors in SSE streams — use abort signals for cleanup
-- Return proper HTTP status codes (4xx/5xx)
-
-### Security
-
-- **Never** use `eval()`, `new Function()`, or implied eval
-- Validate all inputs with Zod schemas
-- Encrypt credentials at rest (AES-256-GCM)
-- Upstream header denylist: `src/shared/constants/upstreamHeaders.ts` — keep sanitize, Zod schemas, and unit tests aligned when editing
-- **Public upstream credentials** (Gemini/Antigravity/Windsurf-style OAuth client_id/secret + Firebase Web keys extracted from public CLIs): **MUST** be embedded via `resolvePublicCred()` from `open-sse/utils/publicCreds.ts` — **never** as string literals. See `docs/security/PUBLIC_CREDS.md` for the mandatory pattern.
-- **Error responses** (HTTP / SSE / executor / MCP handler): **MUST** route through `buildErrorBody()` or `sanitizeErrorMessage()` from `open-sse/utils/error.ts` — **never** put raw `err.stack` or `err.message` in a response body. See `docs/security/ERROR_SANITIZATION.md`.
-- **Shell commands built from variables**: when calling `exec()`/`spawn()` with a script that needs runtime values, pass them via the `env` option (shell-escaped automatically) — **never** string-interpolate untrusted/external paths into the script body. Reference: `src/mitm/cert/install.ts::updateNssDatabases`.
-- **Secure-by-default libraries** ([tldrsec/awesome-secure-defaults](https://github.com/tldrsec/awesome-secure-defaults)): prefer Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink over custom implementations whenever adding new security-sensitive surfaces.
-
----
-
-## Common Modification Scenarios
-
-### Adding a New Provider
-
-1. Register in `src/shared/constants/providers.ts` (Zod-validated at load)
-2. Add executor in `open-sse/executors/` if custom logic needed (extend `BaseExecutor`)
-3. Add translator in `open-sse/translator/` if non-OpenAI format
-4. Add OAuth config in `src/lib/oauth/constants/oauth.ts` if OAuth-based — if the upstream CLI ships a public client_id/secret, embed via `resolvePublicCred()` (see `docs/security/PUBLIC_CREDS.md`), **never** as a literal
-5. Register models in `open-sse/config/providerRegistry.ts`
-6. Write tests in `tests/unit/` (include the publicCreds shape assertion if you added a new embedded default)
-
-### Adding a New API Route
-
-1. Create directory under `src/app/api/v1/your-route/`
-2. Create `route.ts` with `GET`/`POST` handlers
-3. Follow pattern: CORS → Zod body validation → optional auth → handler delegation
-4. Handler goes in `open-sse/handlers/` (import from there, not inline)
-5. Error responses use `buildErrorBody()` / `errorResponse()` from `open-sse/utils/error.ts` (auto-sanitized — never put `err.stack` or `err.message` raw in the body). See `docs/security/ERROR_SANITIZATION.md`.
-6. Add tests — including at least one assertion that error responses do not leak stack traces (`!body.error.message.includes("at /")`)
-
-### Adding a New DB Module
-
-1. Create `src/lib/db/yourModule.ts` — import `getDbInstance` from `./core.ts`
-2. Export CRUD functions for your domain table(s)
-3. Add migration in `src/lib/db/migrations/` if new tables needed
-4. Re-export from `src/lib/localDb.ts` (add to the re-export list only)
-5. Write tests
-
-### Adding a New MCP Tool
-
-1. Add tool definition in `open-sse/mcp-server/tools/` with Zod input schema + async handler
-2. Register in tool set (wired by `createMcpServer()`)
-3. Assign to appropriate scope(s)
-4. Write tests (tool invocation logged to `mcp_audit` table)
-
-### Adding a New A2A Skill
-
-1. Create skill in `src/lib/a2a/skills/` (5 already exist: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
-2. Skill receives task context (messages, metadata) → returns structured result
-3. Register in `A2A_SKILL_HANDLERS` in `src/lib/a2a/taskExecution.ts`
-4. Expose in `src/app/.well-known/agent.json/route.ts` (Agent Card)
-5. Write tests in `tests/unit/`
-6. Document in `docs/frameworks/A2A-SERVER.md` skill table
-
-### Adding a New Cloud Agent
-
-1. Create agent class in `src/lib/cloudAgent/agents/` extending `CloudAgentBase` (3 already exist: codex-cloud, devin, jules)
-2. Implement `createTask`, `getStatus`, `approvePlan`, `sendMessage`, `listSources`
-3. Register in `src/lib/cloudAgent/registry.ts`
-4. Add OAuth/credentials handling if needed (`src/lib/oauth/providers/`)
-5. Tests + document in `docs/frameworks/CLOUD_AGENT.md`
-
-### Adding a New Embedded Service
-
-1. Create installer in `src/lib/services/installers/{name}.ts` modeled on `ninerouter.ts` (use `runNpm` from `installers/utils.ts` — no shell interpolation, hard rule #13).
-2. Register the service in `src/lib/services/bootstrap.ts` (add to `SERVICES[]` array and extend `buildSpawnArgsFactory()`).
-3. Add a DB seed row for the new service in `src/lib/db/migrations/` (`version_manager` table, `status='not_installed'`, `auto_start=0`).
-4. Create 7 API endpoints under `src/app/api/services/{name}/` (`_lib.ts`, `install`, `start`, `stop`, `restart`, `update`, `status`, `auto-start`). All delegate errors through `createErrorResponse()`. The shared `logs` endpoint is already wired via `[name]/logs/route.ts`.
-5. Verify `/api/services/` is in `LOCAL_ONLY_API_PREFIXES` in `src/server/authz/routeGuard.ts`; add a test asserting `isLocalOnlyPath()` returns `true` for the new prefix if you add one (hard rule #17).
-6. Add a UI tab in `src/app/(dashboard)/dashboard/providers/services/tabs/` reusing `ServiceStatusCard`, `ServiceLifecycleButtons`, `ServiceLogsPanel`.
-7. Document in `docs/frameworks/EMBEDDED-SERVICES.md` (update §1 service table + §4 API reference) and `docs/reference/openapi.yaml`.
-8. Write tests: unit (`tests/unit/services/`), integration (`tests/integration/services/`, gated by `RUN_SERVICES_INT=1`), and update `docs/ops/RELEASE_CHECKLIST.md` smoke section.
-
-### Adding a New Guardrail / Eval / Skill / Webhook event
-
-- Guardrail: `src/lib/guardrails/` → docs: `docs/security/GUARDRAILS.md`
-- Eval suite: `src/lib/evals/` → docs: `docs/frameworks/EVALS.md`
-- Skill (sandbox): `src/lib/skills/` → docs: `docs/frameworks/SKILLS.md`
-- Webhook event: `src/lib/webhookDispatcher.ts` → docs: `docs/frameworks/WEBHOOKS.md`
-
----
-
-## Reference Documentation
-
-For any non-trivial change, read the matching deep-dive first:
-
-| Area                                         | Doc                                                               |
-| -------------------------------------------- | ----------------------------------------------------------------- |
-| Repo navigation                              | `docs/architecture/REPOSITORY_MAP.md`                             |
-| Architecture                                 | `docs/architecture/ARCHITECTURE.md`                               |
-| Engineering reference                        | `docs/architecture/CODEBASE_DOCUMENTATION.md`                     |
-| Auto-Combo (9-factor scoring, 14 strategies) | `docs/routing/AUTO-COMBO.md`                                      |
-| Resilience (3 mechanisms)                    | `docs/architecture/RESILIENCE_GUIDE.md`                           |
-| Reasoning replay                             | `docs/routing/REASONING_REPLAY.md`                                |
-| Skills framework                             | `docs/frameworks/SKILLS.md`                                       |
-| Memory system (FTS5 + Qdrant)                | `docs/frameworks/MEMORY.md`                                       |
-| Cloud agents                                 | `docs/frameworks/CLOUD_AGENT.md`                                  |
-| Guardrails (PII / injection / vision)        | `docs/security/GUARDRAILS.md`                                     |
-| Public upstream credentials (Gemini/etc.)    | `docs/security/PUBLIC_CREDS.md`                                   |
-| Error message sanitization                   | `docs/security/ERROR_SANITIZATION.md`                             |
-| Evals                                        | `docs/frameworks/EVALS.md`                                        |
-| Compliance / audit                           | `docs/security/COMPLIANCE.md`                                     |
-| Webhooks                                     | `docs/frameworks/WEBHOOKS.md`                                     |
-| Authorization pipeline                       | `docs/architecture/AUTHZ_GUIDE.md`                                |
-| Stealth (TLS / fingerprint)                  | `docs/security/STEALTH_GUIDE.md`                                  |
-| Agent protocols (A2A / ACP / Cloud)          | `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`                        |
-| MCP server                                   | `docs/frameworks/MCP-SERVER.md`                                   |
-| A2A server                                   | `docs/frameworks/A2A-SERVER.md`                                   |
-| API reference + OpenAPI                      | `docs/reference/API_REFERENCE.md` + `docs/reference/openapi.yaml` |
-| Provider catalog (auto-generated)            | `docs/reference/PROVIDER_REFERENCE.md`                            |
-| Release flow                                 | `docs/ops/RELEASE_CHECKLIST.md`                                   |
-| Embedded services                            | `docs/frameworks/EMBEDDED-SERVICES.md`                            |
-
----
-
-## Testing
-
-| What                    | Command                                                                     |
-| ----------------------- | --------------------------------------------------------------------------- |
-| Unit tests              | `npm run test:unit`                                                         |
-| Single file             | `node --import tsx/esm --test tests/unit/file.test.ts`                      |
-| Vitest (MCP, autoCombo) | `npm run test:vitest`                                                       |
-| E2E (Playwright)        | `npm run test:e2e`                                                          |
-| Protocol E2E (MCP+A2A)  | `npm run test:protocols:e2e`                                                |
-| Ecosystem               | `npm run test:ecosystem`                                                    |
-| Coverage gate           | `npm run test:coverage` (60/60/60/60 — statements/lines/functions/branches) |
-| Coverage report         | `npm run coverage:report`                                                   |
-
-**PR rule**: If you change production code in `src/`, `open-sse/`, `electron/`, or `bin/`, you must include or update tests in the same PR.
-
-**Test layer preference**: unit first → integration (multi-module or DB state) → e2e (UI/workflow only). Encode bug reproductions as automated tests before or alongside the fix.
-
-**Both test runners must pass**: `npm run test:unit` (Node native — most tests) AND `npm run test:vitest` (MCP server, autoCombo, cache) cover **non-overlapping files**. Both must be green before merging. A PR where only one suite passes may silently ship broken MCP tools or routing regressions.
-
-**Bug fix / issue triage protocol (Hard Rule #18)**: Every fix for a reported issue must be validated by one of the following — no exceptions:
-1. **TDD (preferred)** — write a failing test reproducing the bug → fix it → confirm the test passes. The test becomes the permanent regression guard. Touch only the files the test proves need changing; nothing more.
-2. **Real-environment test (when TDD is not possible)** — deploy to the production VPS (`root@192.168.0.15`) and run a documented live test. Record the exact command + result in the PR description. Applies to: OAuth upstream flows, Cloudflare/WS upstream behavior, UI-only regressions, hardware-dependent behavior.
-3. "It worked locally without a test" does not count. A fix without a test or a VPS validation record is not a fix — it is a guess.
-
-Why this matters: fixing bug A while opening bug B is worse than not fixing at all. The TDD/VPS gate enforces surgical scope — you touch only what the failing test proves is broken. Examples where this paid off: #3090 (claude-web 403), #3113 (WS HTTP fallback), #3052 (heap-guard auto-calibration).
-
-**Copilot coverage policy**: When a PR changes production code and coverage is below 60% (statements/lines/functions/branches), do not just report — add or update tests, rerun the coverage gate, then ask for confirmation. Include commands run, changed test files, and final coverage result in the PR report.
-
----
-
-## Git Workflow
-
+Tests (vitest, in `tests/`, an **independent** ESM package — not wired into root `npm test`):
 ```bash
-# Never commit directly to main
-git checkout -b feat/your-feature
-git commit -m "feat: describe your change"
-git push -u origin feat/your-feature
+npm install                             # ROOT deps first — tests import from src/ which needs `open`, `undici`, etc.
+cd tests && npm install                 # then tests' own deps (vitest) → tests/node_modules (allowed by tests/.gitignore)
+npx vitest run                          # all tests; auto-discovers tests/vitest.config.js
+npx vitest run unit/capabilities.test.js   # single file (path relative to tests/)
 ```
-
-**Branch prefixes**: `feat/`, `fix/`, `refactor/`, `docs/`, `test/`, `chore/`
-
-**Commit format** (Conventional Commits): `feat(db): add circuit breaker` — scopes: `db`, `sse`, `oauth`, `dashboard`, `api`, `cli`, `docker`, `ci`, `mcp`, `a2a`, `memory`, `skills`
-
-**Husky hooks**:
-
-- **pre-commit**: lint-staged + `check-docs-sync` + `check:any-budget:t11`
-- **pre-push**: `npm run test:unit`
-
----
-
-## Environment
-
-- **Runtime**: Node.js ≥20.20.2 <21 || ≥22.22.2 <23 || ≥24 <25, ES Modules
-- **TypeScript**: 5.9+, target ES2022, module esnext, resolution bundler
-- **Path aliases**: `@/*` → `src/`, `@omniroute/open-sse` → `open-sse/`, `@omniroute/open-sse/*` → `open-sse/*`
-- **Default port**: 20128 (API + dashboard on same port)
-- **Data directory**: `DATA_DIR` env var, defaults to `~/.omniroute/`
-- **Key env vars**: `PORT`, `JWT_SECRET`, `API_KEY_SECRET`, `INITIAL_PASSWORD`, `REQUIRE_API_KEY`, `APP_LOG_LEVEL`
-- Setup: `cp .env.example .env` then generate `JWT_SECRET` (`openssl rand -base64 48`) and `API_KEY_SECRET` (`openssl rand -hex 32`)
-
----
-
-## Hard Rules
-
-1. Never commit secrets or credentials
-2. Never add logic to `localDb.ts`
-3. Never use `eval()` / `new Function()` / implied eval
-4. Never commit directly to `main`
-5. Never write raw SQL in routes — use `src/lib/db/` modules
-6. Never silently swallow errors in SSE streams
-7. Always validate inputs with Zod schemas
-8. Always include tests when changing production code
-9. Coverage must stay ≥60% (statements, lines, functions, branches).
-10. Never bypass Husky hooks (`--no-verify`, `--no-gpg-sign`) without explicit operator approval.
-11. Never embed public upstream OAuth client_id/secret or Firebase Web keys as string literals — always go through `resolvePublicCred()` (`open-sse/utils/publicCreds.ts`). See `docs/security/PUBLIC_CREDS.md`.
-12. Never return raw `err.stack` / `err.message` in HTTP / SSE / executor responses — always route through `buildErrorBody()` or `sanitizeErrorMessage()` (`open-sse/utils/error.ts`). See `docs/security/ERROR_SANITIZATION.md`.
-13. Never string-interpolate external paths or runtime values into shell scripts passed to `exec()`/`spawn()` — pass via the `env` option instead. Reference: `src/mitm/cert/install.ts::updateNssDatabases`.
-14. Never dismiss a CodeQL / Secret-Scanning alert without (a) first checking the pattern docs above to see if the helper applies, and (b) recording the technical justification in the dismissal comment. Precedent: `js/stack-trace-exposure` raised on callsites that already route through `sanitizeErrorMessage()` is a known CodeQL limitation (custom sanitizers not recognized) — dismiss as `false positive` referencing `docs/security/ERROR_SANITIZATION.md`.
-15. Never expose routes that spawn child processes (`/api/mcp/`, `/api/cli-tools/runtime/`) without `isLocalOnlyPath()` classification in `src/server/authz/routeGuard.ts`. Loopback enforcement happens unconditionally before any auth check — leaked JWT via tunnel cannot trigger process spawning. See `docs/security/ROUTE_GUARD_TIERS.md`.
-16. Never include `Co-Authored-By` trailers that credit an AI assistant, LLM, or automation account (e.g. names containing "Claude", "GPT", "Copilot", "Bot"; emails at `anthropic.com` / `openai.com` / bot-owned `noreply.github.com` addresses). Such trailers route attribution to the bot account on GitHub, hiding the real author (`diegosouzapw`) in PR history. Human collaborators — including upstream PR authors and issue reporters being ported into OmniRoute — MAY and SHOULD be credited with standard `Co-authored-by: Name <email>` trailers; the upstream-port workflows (`/port-upstream-features`, `/port-upstream-issues`) depend on this.
-17. Never expose routes under `/api/services/` or `/dashboard/providers/services/*/embed/` without `isLocalOnlyPath()` classification in `src/server/authz/routeGuard.ts`. These routes can spawn child processes (`npm install`, `node`). Loopback enforcement happens unconditionally before any auth check — a leaked JWT via tunnel cannot trigger process spawning. See `docs/security/ROUTE_GUARD_TIERS.md`.
-18. Every bug fix must be validated before shipping: a failing-then-passing unit/integration test (TDD) OR a documented live test on the production VPS (192.168.0.15). A fix without either is not merged. See Testing → "Bug fix / issue triage protocol" for the full decision tree.
-
----
-
-## PII & Stream Sanitization Learnings
-
-### 1. Regex Security (ReDoS)
-All regex patterns matching variable-length strings (e.g. IPv6 address, credit cards) must use strictly bounded, non-overlapping sequences (e.g., limit occurrences with bounded ranges `{1,7}`) to prevent catastrophic backtracking when processing untrusted inputs.
-
-### 2. SSE Snapshot Handling
-When parsing streaming LLM responses (e.g. Responses API), check if a chunk represents a final snapshot (`done` or `completed` events). Snapshot text must be sanitized directly as a standalone string (bypassing rolling delta buffers) to prevent text duplication at the end of the stream.
-
-### 3. Database Handles in Tests
-Ensure that any unit tests that trigger database migrations or establish SQLite connections call `resetDbInstance()` and properly clean up/close all DB handles in a `test.after(...)` hook. Failure to release database connection handles will cause Node's native test runner to hang indefinitely.
+> The committed `tests/package.json` `test` script hardcodes Unix paths (`NODE_PATH=/tmp/node_modules …`) — a shared-install workaround from upstream. On Windows (or anywhere), ignore it and use the `npx vitest` form above; `vitest.config.js` resolves the `open-sse`/`@/` aliases from the repo root regardless of where vitest lives.
+>
+> **The suite is NOT expected to be all-green on a plain checkout.** ~938 pass, ~64 fail. Judge regressions with `tests/__baseline__/verify-no-regression.mjs`, not a raw run. Expected red:
+> - 26 catalogued in `tests/__baseline__/known-fails.txt` (rtk, oauth-cursor-auto-import, translator-request-normalization, …).
+> - `unit/embeddings.cloud.test.js` imports `cloud/src/handlers/embeddings.js` — the `cloud/` worker dir is **not in this repo**, so it always fails here.
+> - `unit/xai-oauth-service.test.js` times out (5s) when the xAI endpoint-discovery fetch isn't reachable/mocked.
+> - `real/*.real.test.js` make live provider calls — need credentials, skip otherwise.
+- `*.real.test.js` under `tests/translator/real/` make live provider calls — skip unless credentials are set.
+- Regression baselines: `tests/__baseline__/verify-*.mjs` compare against committed snapshots (providers, aliases, OAuth URLs). Run these after touching provider registry / alias logic.
+
+## Architecture
+
+Two authoritative docs already exist — read them before working in these areas rather than re-deriving:
+- `docs/ARCHITECTURE.md` — full system: request lifecycle, combo/account fallback, OAuth + token refresh, cloud sync, data model.
+- `open-sse/AGENTS.md` — the routing/translation engine's own conventions and "how to add a provider/executor/translator". **Read this before editing anything under `open-sse/`.**
+
+### Request flow (the thing to understand first)
+`src/app/api/v1/*` route (Next rewrite maps `/v1/*` → `/api/v1/*` in `next.config.mjs`)
+→ `src/sse/handlers/chat.js` (parse, combo expansion, account-selection loop)
+→ `open-sse/handlers/chatCore.js` (detect source format, translate request, dispatch to executor, retry/refresh, stream setup)
+→ `open-sse/executors/*` (per-provider upstream call; `default.js` handles any OpenAI-compatible provider)
+→ `open-sse/translator/*` (client format ↔ provider format)
+→ SSE back to client.
+
+`src/sse/` is the app-side entry glue; `open-sse/` is the provider-agnostic engine (also usable standalone). Cross that boundary consciously.
+
+### Translator engine (`open-sse/translator/`)
+- Pivots through **OpenAI as the intermediate format**. A translator registered on an exact `source:target` pair (e.g. `claude:kiro`) runs as a **direct route**, skipping the lossy double-hop. Prefer a direct route for fragile pairs (thinking blocks, tool ids, non-base64 images, `is_error`).
+- Translators **self-register** via `register(from, to, reqFn, resFn)` as an import side effect — a new translator file MUST be imported in `open-sse/translator/index.js` or it never runs.
+- Never hardcode role/block/model strings — use `open-sse/translator/schema/` and `open-sse/config/` constants. Config-driven and DRY is enforced by convention here.
+
+### Provider registry (`open-sse/providers/registry/*`)
+- One file per provider. `providers/registry/index.js` is an **auto-generated** static import list — regenerate it with `scripts/migrate-registry.mjs` / `injectDisplayToRegistry.mjs`, don't hand-edit.
+- Add a provider: copy `providers/REGISTRY_TEMPLATE.js`, add models to `config/providerModels.js`. Only add an executor for non-OpenAI-compatible upstreams.
+
+### Persistence — IMPORTANT (ARCHITECTURE.md is stale here)
+State is **no longer `db.json`**. It's a SQLite layer under `src/lib/db/` with an adapter fallback chain (`driver.js`): `bun:sqlite` → `better-sqlite3` (optional native dep) → `node:sqlite` (Node ≥22.5) → `sql.js` (pure-JS fallback, always works). `better-sqlite3` is deliberately in `optionalDependencies` so install never fails without build tools.
+- `src/lib/localDb.js` is a **backward-compat shim** re-exporting `src/lib/db/index.js`. New code should import from `@/lib/db/index.js`; per-entity logic lives in `src/lib/db/repos/*`. Schema/migrations in `src/lib/db/migrations/`.
+- DB file location resolves via `src/lib/db/paths.js` (`DATA_DIR`, else `~/.9router/`).
+- Usage/logs (`src/lib/usageDb.js`, `usage.json` + `log.txt`) still live under `~/.9router` and do **not** follow `DATA_DIR`.
+
+### RTK token saver (`open-sse/rtk/`)
+Pre-translate hooks that compress `tool_result` content in-place to cut tokens. **Fail-open**: any error returns null and leaves the body untouched — never throw out of them. Skips `is_error`/`status:"error"` results to preserve traces.
+
+## Conventions & gotchas
+
+- Plain JavaScript (ESM), no TypeScript. `@/*` path alias → `src/*` (`jsconfig.json`).
+- `custom-server.js` wraps the Next standalone server to derive client IP from the TCP socket and strip attacker-controlled `X-Forwarded-For` — trusting forwarding headers only from a loopback reverse proxy. Preserve this when touching request/IP/rate-limit code.
+- Security-sensitive env: `JWT_SECRET` (session cookie), `INITIAL_PASSWORD` (default `123456` — must override), `API_KEY_SECRET`, `MACHINE_ID_SALT`. Full env contract in `.env.example` and ARCHITECTURE.md's env matrix.
+- Binary/protobuf upstreams (kiro EventStream, cursor protobuf, commandcode NDJSON) don't round-trip through OpenAI — they're handled inside their own executor, not the translator.
+- Versioning: root and `cli/` are versioned independently; changes are logged in `CHANGELOG.md`. Commit style is Conventional Commits (`fix(translator): …`, `feat(...)`).

DOCKER.md

@@ -0,0 +1,132 @@
+# Docker
+
+Run 9Router in a container. Published image: [`decolua/9router`](https://hub.docker.com/r/decolua/9router) — multi-platform `linux/amd64` + `linux/arm64`.
+
+---
+
+# 👤 For Users
+
+## Quick start
+
+```bash
+docker run -d \
+  -p 20128:20128 \
+  -v "$HOME/.9router:/app/data" \
+  -e DATA_DIR=/app/data \
+  --name 9router \
+  decolua/9router:latest
+```
+
+App listens on port `20128`. Open: http://localhost:20128
+
+## Manage container
+
+```bash
+docker logs -f 9router        # view logs
+docker stop 9router           # stop
+docker start 9router          # start again
+docker rm -f 9router          # remove
+```
+
+## Data persistence
+
+```bash
+-v "$HOME/.9router:/app/data" \
+-e DATA_DIR=/app/data
+```
+
+Without `DATA_DIR`, the app falls back to `~/.9router/` (macOS/Linux) or `%APPDATA%\9router\` (Windows). In the container, `DATA_DIR=/app/data` makes the bind mount work.
+
+Data layout under `$DATA_DIR/`:
+
+```text
+$DATA_DIR/
+├── db/
+│   ├── data.sqlite       # main SQLite database
+│   └── backups/          # auto backups
+└── ...                   # certs, logs, runtime configs
+```
+
+Host path: `$HOME/.9router/db/data.sqlite`
+Container path: `/app/data/db/data.sqlite`
+
+## Optional env vars
+
+```bash
+docker run -d \
+  -p 20128:20128 \
+  -v "$HOME/.9router:/app/data" \
+  -e DATA_DIR=/app/data \
+  -e PORT=20128 \
+  -e HOSTNAME=0.0.0.0 \
+  -e DEBUG=true \
+  --name 9router \
+  decolua/9router:latest
+```
+
+## Optional Headroom sidecar
+
+The 9Router image does not bundle Python or Headroom. To use Headroom in Docker, run it as a separate service and point 9Router at that proxy:
+
+```yaml
+services:
+  9router:
+    image: decolua/9router:latest
+    ports:
+      - "20128:20128"
+    volumes:
+      - "$HOME/.9router:/app/data"
+    environment:
+      DATA_DIR: /app/data
+      HEADROOM_URL: http://headroom:8787
+    depends_on:
+      - headroom
+
+  headroom:
+    image: ghcr.io/chopratejas/headroom:latest
+    ports:
+      - "8787:8787"
+```
+
+In the dashboard, open `Endpoint` → `Token Saver` → `Headroom`, confirm the URL is `http://headroom:8787`, recheck status, then enable Headroom.
+
+If Headroom runs on the Docker host instead of as a sidecar, use `http://host.docker.internal:8787` on macOS/Windows. On Linux, add `--add-host=host.docker.internal:host-gateway` or the equivalent compose `extra_hosts` entry.
+
+## Update to latest
+
+```bash
+docker pull decolua/9router:latest
+docker rm -f 9router
+# re-run the quick start command
+```
+
+---
+
+# 🛠 For Developers
+
+## Build image locally (test)
+
+```bash
+cd app && docker build -t 9router .
+
+docker run --rm -p 20128:20128 \
+  -v "$HOME/.9router:/app/data" \
+  -e DATA_DIR=/app/data \
+  9router
+```
+
+## Publish (automatic via CI)
+
+Push a git tag `v*` → GitHub Actions builds multi-platform (amd64+arm64) and pushes to:
+- `ghcr.io/decolua/9router:v{version}` + `:latest`
+- `decolua/9router:v{version}` + `:latest`
+
+```bash
+# Use scripts/release.js (recommended)
+node scripts/release.js "Release title" "Notes"
+
+# Or manually
+git tag v0.4.x && git push origin v0.4.x
+```
+
+Workflow: `app/.github/workflows/docker-publish.yml`

Dockerfile

@@ -1,161 +1,46 @@
-# ── Common base with runtime deps ──────────────────────────────────────────
-FROM node:24-trixie-slim AS base
+# syntax=docker/dockerfile:1.7
+ARG NODE_IMAGE=node:22-alpine
+FROM ${NODE_IMAGE} AS base
 WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
 
-RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \
-  apt-get update \
-  && apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \
-  && rm -rf /var/lib/apt/lists/*
-
-# ── Builder ────────────────────────────────────────────────────────────────
 FROM base AS builder
-
-# Build tools for native module compilation
-# apt-get update needed here because base's rm -rf clears the shared cache
-RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \
-  apt-get update \
-  && apt-get install -y --no-install-recommends python3 make g++ \
-  && rm -rf /var/lib/apt/lists/*
-
-COPY package*.json ./
-COPY scripts/build/postinstall.mjs ./scripts/build/postinstall.mjs
-COPY scripts/build/postinstallSupport.mjs ./scripts/build/postinstallSupport.mjs
-COPY scripts/build/native-binary-compat.mjs ./scripts/build/native-binary-compat.mjs
-ENV NPM_CONFIG_LEGACY_PEER_DEPS=true
-# --ignore-scripts blocks broad dependency install/postinstall hooks, closing
-# the supply-chain attack surface where a transitive dep can run arbitrary code
-# at install time. better-sqlite3 still needs a native binding for the target
-# platform, so rebuild and smoke-test only that known runtime dependency below.
-#
-# We REQUIRE a committed package-lock.json so resolved dependency versions
-# are reproducible.
-RUN test -f package-lock.json \
-  || (echo "package-lock.json is required for reproducible Docker builds" >&2 && exit 1)
+RUN apk --no-cache upgrade && apk --no-cache add python3 make g++ linux-headers
+COPY package.json ./
 RUN --mount=type=cache,target=/root/.npm \
-  npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
-  && npm rebuild better-sqlite3 \
-  && node -e "require('better-sqlite3')(':memory:').close()"
-
-# Use Turbopack for significant build speedup
-ENV OMNIROUTE_USE_TURBOPACK=1
-
+  npm install
 COPY . ./
-RUN --mount=type=cache,target=/app/.build/next/cache \
-  mkdir -p /app/data && npm run build
-
-# ── Runner base ────────────────────────────────────────────────────────────
-FROM base AS runner-base
-
-LABEL org.opencontainers.image.title="omniroute" \
-  org.opencontainers.image.description="Unified AI proxy — route any LLM through one endpoint" \
-  org.opencontainers.image.url="https://omniroute.online" \
-  org.opencontainers.image.source="https://github.com/diegosouzapw/OmniRoute" \
-  org.opencontainers.image.licenses="MIT"
+ENV NEXT_TELEMETRY_DISABLED=1
+RUN npm run build:hf
 
+FROM ${NODE_IMAGE} AS runner
+WORKDIR /app
+LABEL org.opencontainers.image.title="9router-hf"
 ENV NODE_ENV=production
 ENV PORT=7860
 ENV HOSTNAME=0.0.0.0
-ENV OMNIROUTE_MEMORY_MB=1024
-ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_MEMORY_MB}"
-
-# Data directory inside Docker — defaults to /data for compatibility with Hugging Face Space persistent storage
-ENV DATA_DIR=/data
-RUN mkdir -p /data && chown -R node:node /data
-
-# `npm run build` (build-next-isolated → assembleStandalone) bundles ALL runtime
-# files into .build/next/standalone/ — .next, node_modules, migrations, scripts,
-# docs, and the previously hand-COPY'd modules below (@swc/helpers, pino-*, split2,
-# migrations). assembleStandalone copies them straight from the builder's
-# node_modules, so they are present regardless of NFT/Turbopack trace behaviour.
-# The old per-module overrides were therefore pure duplication and were removed
-# (build-output-isolation cleanup). See scripts/build/assembleStandalone.mjs
-# (EXTRA_MODULE_ENTRIES) for the single source of truth.
-COPY --from=builder /app/.build/next/standalone ./
-# better-sqlite3 is the one exception still copied explicitly: assembleStandalone
-# only syncs its native build/ dir; the JS wrapper (lib/, package.json) is left to
-# Next.js tracing. bootstrap-env requires SQLite BEFORE the standalone server
-# starts, so guarantee the complete package independent of trace behaviour.
-COPY --from=builder /app/node_modules/better-sqlite3 ./node_modules/better-sqlite3
-# migrations land at <standalone>/migrations via assembleStandalone; point the runtime at them.
-ENV OMNIROUTE_MIGRATIONS_DIR=/app/migrations
-
-# Docker healthcheck script — not traced by Next.js standalone output, so copy
-# it explicitly. The HEALTHCHECK CMD references it as `node healthcheck.mjs`.
-COPY --from=builder /app/scripts/dev/healthcheck.mjs ./healthcheck.mjs
-
-# Hand /app over to the baked-in `node` non-root user (UID/GID 1000) so the
-# runtime process never holds root privileges. The chown happens after all
-# COPYs so it covers files originally owned by root in the builder stage.
-RUN chown -R node:node /app
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV DATA_DIR=/app/data
+
+COPY --from=builder /app/public ./public
+COPY --from=builder /app/.next/static ./.next/static
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/custom-server.js ./custom-server.js
+COPY --from=builder /app/hf-server.js ./hf-server.js
+COPY --from=builder /app/open-sse ./open-sse
+COPY --from=builder /app/src/mitm ./src/mitm
+COPY --from=builder /app/node_modules/node-forge ./node_modules/node-forge
+COPY --from=builder /app/node_modules/next ./node_modules/next
+COPY --from=builder /app/node_modules/sql.js ./node_modules/sql.js
+
+RUN mkdir -p /app/data && chown -R node:node /app && \
+  mkdir -p /app/data-home && chown node:node /app/data-home && \
+  ln -sf /app/data-home /root/.9router 2>/dev/null || true
+
+RUN apk --no-cache upgrade && apk --no-cache add su-exec && \
+  printf '#!/bin/sh\nchown -R node:node /app/data /app/data-home 2>/dev/null\nexec su-exec node "$@"\n' > /entrypoint.sh && \
+  chmod +x /entrypoint.sh
 
 EXPOSE 7860
-
-# Drop to non-root before ENTRYPOINT/CMD so every derived stage (runner-cli,
-# runner-web) also runs as a non-root user unless they explicitly switch back.
-USER node
-
-# Warns if the mounted data volume has wrong ownership
-COPY --chmod=755 scripts/check-permissions.sh /tmp/check-permissions.sh
-ENTRYPOINT ["/tmp/check-permissions.sh"]
-
-HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD ["node", "healthcheck.mjs"]
-
-CMD ["node", "dev/run-standalone.mjs"]
-
-# ── Runner Web (web-cookie providers: Gemini Web, Claude Turnstile) ───────────
-#
-#  Two image flavors:
-#    runner-base  →  omniroute:VERSION        Lean base (~500 MB). No browsers.
-#    runner-web   →  omniroute:VERSION-web    +Chromium/Playwright (~800 MB).
-#
-#  Use runner-web when you need web-cookie providers (gemini-web, claude-web,
-#  claude-turnstile). For all other providers runner-base is sufficient.
-#
-#  Build:
-#    docker build --target runner-web -t omniroute:web .
-#  Compose:
-#    build:
-#      context: .
-#      target: runner-web
-FROM runner-base AS runner-web
-
-USER root
-
-# Install Playwright browser binaries + OS dependencies under root, then hand
-# ownership of the browsers cache to the node user.
-# PLAYWRIGHT_BROWSERS_PATH overrides the default ~/.cache/ms-playwright so the
-# browsers land under /home/node which persists across image layers and is
-# accessible to the non-root runtime user.
-ENV PLAYWRIGHT_BROWSERS_PATH=/home/node/.cache/ms-playwright
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
-  apt-get update \
-  && npx playwright install chromium --with-deps \
-  && chown -R node:node /home/node/.cache \
-  && rm -rf /var/lib/apt/lists/*
-
-USER node
-
-FROM runner-base AS runner-cli
-
-# Drop back to root briefly so we can install system + global npm packages,
-# then return to the `node` non-root user before the CMD inherited from
-# runner-base runs.
-USER root
-
-# Install system dependencies required by openclaw (git+ssh references).
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
-  apt-get update \
-  && apt-get install -y --no-install-recommends git ca-certificates docker.io docker-compose \
-  && rm -rf /var/lib/apt/lists/* \
-  && git config --system url."https://github.com/".insteadOf "ssh://git@github.com/"
-
-# Install CLI tools globally. Separate layer from apt for better cache reuse.
-RUN --mount=type=cache,target=/root/.npm \
-  npm install -g --no-audit --no-fund @openai/codex @anthropic-ai/claude-code droid openclaw@latest
-
-USER node
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["node", "hf-server.js"]

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 diegosouzapw
+Copyright (c) 2024-2026 decolua and contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,10 +1,1526 @@
----
-title: Hahma
-emoji: 📊
-colorFrom: gray
-colorTo: pink
-sdk: docker
-pinned: false
----
-
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+<div align="center">
+  <img src="./images/9router.png?1" alt="9Router Dashboard" width="800"/>
+  
+  # 9Router - FREE AI Router & Token Saver
+  
+  **Never stop coding. Save 20-40% tokens with RTK + auto-fallback to FREE & cheap AI models.**
+  
+  **Connect All AI Code Tools (Claude Code, Cursor, Antigravity, Copilot, Codex, Gemini, OpenCode, Cline, OpenClaw...) to 40+ AI Providers & 100+ Models.**
+  
+  [![npm](https://img.shields.io/npm/v/9router.svg)](https://www.npmjs.com/package/9router)
+  [![Downloads](https://img.shields.io/npm/dm/9router.svg)](https://www.npmjs.com/package/9router)
+  [![Docker Pulls](https://img.shields.io/docker/pulls/decolua/9router.svg?logo=docker&label=Docker%20pulls)](https://hub.docker.com/r/decolua/9router)
+  [![GHCR](https://img.shields.io/badge/GHCR-decolua%2F9router-blue?logo=github)](https://github.com/decolua/9router/pkgs/container/9router)
+  [![License](https://img.shields.io/npm/l/9router.svg)](https://github.com/decolua/9router/blob/main/LICENSE)
+
+<a href="https://trendshift.io/repositories/22628" target="_blank"><img src="https://trendshift.io/api/badge/repositories/22628" alt="decolua%2F9router | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
+
+[🚀 Quick Start](#-quick-start) • [💡 Features](#-key-features) • [📖 Setup](#-setup-guide) • [🌐 Website](https://9router.com)
+
+[🇧🇷 Português (Brasil)](./i18n/README.pt-BR.md) • [🇻🇳 Tiếng Việt](./i18n/README.vi.md) • [🇨🇳 中文](./i18n/README.zh-CN.md) • [🇯🇵 日本語](./i18n/README.ja-JP.md) • [🇷🇺 Русский](./i18n/README.ru.md) • [🇹🇭 ไทย](./i18n/README.th.md) • [🇮🇷 فارسی](./i18n/README.fa_IR.md) • [🇮🇩 Indonesia](./i18n/README.id-ID.md) • [🇪🇸 Español](./i18n/README.es.md) • [🇫🇷 Français](./i18n/README.fr.md)
+
+</div>
+
+---
+
+## 🤔 Why 9Router?
+
+**Stop wasting money, tokens and hitting limits:**
+
+- ❌ Subscription quota expires unused every month
+- ❌ Rate limits stop you mid-coding
+- ❌ Tool outputs (git diff, grep, ls...) burn tokens fast
+- ❌ Expensive APIs ($20-50/month per provider)
+- ❌ Manual switching between providers
+
+**9Router solves this:**
+
+- ✅ **RTK Token Saver** - Auto-compress tool_result content, save 20-40% tokens per request
+- ✅ **Maximize subscriptions** - Track quota, use every bit before reset
+- ✅ **Auto fallback** - Subscription → Cheap → Free, zero downtime
+- ✅ **Multi-account** - Round-robin between accounts per provider
+- ✅ **Universal** - Works with Claude Code, Codex, Cursor, Cline, any CLI tool
+
+---
+
+## 🔄 How It Works
+
+```
+┌─────────────┐
+│  Your CLI   │  (Claude Code, Codex, OpenClaw, Cursor, Cline...)
+│   Tool      │
+└──────┬──────┘
+       │ http://localhost:20128/v1
+       ↓
+┌─────────────────────────────────────────────┐
+│           9Router (Smart Router)            │
+│  • RTK Token Saver (cut tool_result tokens) │
+│  • Format translation (OpenAI ↔ Claude)     │
+│  • Quota tracking                           │
+│  • Auto token refresh                       │
+└──────┬──────────────────────────────────────┘
+       │
+       ├─→ [Tier 1: SUBSCRIPTION] Claude Code, Codex, GitHub Copilot
+       │   ↓ quota exhausted
+       ├─→ [Tier 2: CHEAP] GLM ($0.6/1M), MiniMax ($0.2/1M)
+       │   ↓ budget limit
+       └─→ [Tier 3: FREE] Kiro, OpenCode Free, Vertex ($300 credits)
+
+Result: Never stop coding, minimal cost + 20-40% token savings via RTK
+```
+
+---
+
+## ⚡ Quick Start
+
+**1. Install globally:**
+
+```bash
+npm install -g 9router
+9router
+```
+
+🎉 Dashboard opens at `http://localhost:20128`
+
+**2. Connect a FREE provider (no signup needed):**
+
+Dashboard → Providers → Connect **Kiro AI** (~50 credits/month free: Claude 4.5 + GLM-5 + MiniMax) or **OpenCode Free** (no auth) → Done!
+
+**3. Use in your CLI tool:**
+
+```
+Claude Code/Codex/OpenClaw/Cursor/Cline Settings:
+  Endpoint: http://localhost:20128/v1
+  API Key: [copy from dashboard]
+  Model: kr/claude-sonnet-4.5
+```
+
+**That's it!** Start coding with FREE AI models.
+
+**Alternative: run from source (this repository):**
+
+This repository package is private (`9router-app`), so source/Docker execution is the expected local development path.
+
+```bash
+cp .env.example .env
+npm install
+PORT=20128 NEXT_PUBLIC_BASE_URL=http://localhost:20128 npm run dev
+```
+
+Production mode:
+
+```bash
+npm run build
+PORT=20128 HOSTNAME=0.0.0.0 NEXT_PUBLIC_BASE_URL=http://localhost:20128 npm run start
+```
+
+Default URLs:
+
+- Dashboard: `http://localhost:20128/dashboard`
+- OpenAI-compatible API: `http://localhost:20128/v1`
+
+---
+
+## Video Guides
+
+<div align="center">
+
+<table>
+  <tr>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=X69n5Lm06Yw">
+        <img src="https://img.youtube.com/vi/X69n5Lm06Yw/maxresdefault.jpg" alt="Tiết kiệm chi phí LLM với 9Router" width="300"/>
+      </a><br/>
+      <b>🇻🇳 Tiếng Việt</b><br/>
+      <sub>Tiết kiệm chi phí LLM cho OpenClaw với 9Router<br/>by <a href="https://www.youtube.com/c/M%C3%ACAIblog">Mì AI</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://youtu.be/VQAw612S27Y">
+        <img src="https://img.youtube.com/vi/VQAw612S27Y/maxresdefault.jpg" alt="9Router + Claude Code FREE Unlimited Setup" width="300"/>
+      </a><br/>
+      <b>🇵🇰 اردو / हिन्दी</b><br/>
+      <sub>9Router + Claude Code FREE Unlimited Setup<br/>by <a href="https://www.youtube.com/@BuildAIWithHamid">Build AI With Hamid</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=raEyZPg5xE0">
+        <img src="https://img.youtube.com/vi/raEyZPg5xE0/maxresdefault.jpg" alt="9Router Setup Tutorial" width="300"/>
+      </a><br/>
+      <b>🇺🇸 English</b><br/>
+      <sub>9Router + Claude Code FREE Setup<br/>by <a href="https://www.youtube.com/@BuildAIWithHamid">Build AI With Hamid</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://youtu.be/3dF5GIYMrcQ?si=bAyfyiHbARJQAHj_">
+        <img src="https://img.youtube.com/vi/3dF5GIYMrcQ/hqdefault.jpg" alt="9Router Setup Tutorial" width="300"/>
+      </a><br/>
+      <b>🇺🇸 English</b><br/>
+      <sub>9Router + Claude Code FREE Setup<br/>by <a href="https://www.youtube.com/@BuildAIWithHamid">Build AI With Hamid</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=o3qYCyjrFYg">
+        <img src="https://img.youtube.com/vi/o3qYCyjrFYg/maxresdefault.jpg" alt="Claude Code FREE Forever" width="300"/>
+      </a><br/>
+      <b>🇺🇸 English</b><br/>
+      <sub>Claude Code FREE Forever — Unlimited Models<br/>by <a href="https://www.youtube.com/@BuildAIWithHamid">Build AI With Hamid</a></sub>
+    </td>
+  </tr>
+  <tr>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=Ttpc26m39Dw">
+        <img src="https://img.youtube.com/vi/Ttpc26m39Dw/maxresdefault.jpg" alt="Claude CLI Free Setup" width="300"/>
+      </a><br/>
+      <b>🇺🇸 English</b><br/>
+      <sub>Claude CLI Free Setup with 9Router 🚀<br/>by <a href="https://www.youtube.com/@CodeVerseSoban">CodeVerse Soban</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=G-5A_D5Pm6Y">
+        <img src="https://img.youtube.com/vi/G-5A_D5Pm6Y/maxresdefault.jpg" alt="Cài đặt OpenClaw Free A-Z" width="300"/>
+      </a><br/>
+      <b>🇻🇳 Tiếng Việt</b><br/>
+      <sub>Cài Đặt OpenClaw Free Từ A-Z + 9Router<br/>by <a href="https://www.youtube.com/@maigia">Mai Gia</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=JXmg8_gccgE">
+        <img src="https://img.youtube.com/vi/JXmg8_gccgE/maxresdefault.jpg" alt="FREE OpenClaw with Claude Opus" width="300"/>
+      </a><br/>
+      <b>🇺🇸 English</b><br/>
+      <sub>FREE OpenClaw + Claude Opus 4.6<br/>by <a href="https://www.youtube.com/@BuildAIWithHamid">Build AI With Hamid</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=CkVZZUSTXAI">
+        <img src="https://img.youtube.com/vi/CkVZZUSTXAI/mqdefault.jpg" alt="Claude CLI Free Setup" width="300"/>
+      </a><br/>
+      <b>🇮🇩 Indonesia</b><br/>
+      <sub>Koding 24 Jam Anti Rate Limit! Hemat Token AI 65% | Tutorial Quick Setup 9Router 🚀<br/>by <a href="https://www.youtube.com/@krisswuh">Krisswuh</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=TXGv4eofe1I">
+        <img src="https://img.youtube.com/vi/TXGv4eofe1I/mqdefault.jpg" alt="Cara Deploy 9Router di Hugging Face GRATIS Non-Stop! | Alternatif VPS RAM 16GB" width="300"/>
+      </a><br/>
+      <b>🇮🇩 Indonesia</b><br/>
+      <sub>Cara Deploy 9Router di Hugging Face GRATIS Non-Stop! | Alternatif VPS RAM 16GB<br/>by <a href="https://www.youtube.com/@krisswuh">Krisswuh</a></sub>
+    </td>
+  </tr>
+  <tr>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=GyX-DLvePW8">
+        <img src="https://img.youtube.com/vi/GyX-DLvePW8/hqdefault.jpg" alt="این شکلی از هر API ای استفاده کن برای هوش مصنوعی" width="300"/>
+      </a><br/>
+      <b>🇮�� Persian-فارسی</b><br/>
+      <sub dir="rtl">این شکلی از هر API ای استفاده کن برای هوش مصنوعی<br/>by <a href="https://www.youtube.com/@Matin_SenPai">Matin SenPai</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=hPusYX-5Pmw">
+        <img src="https://img.youtube.com/vi/hPusYX-5Pmw/maxresdefault.jpg" alt="Hướng Dẫn Setup OpenClaw + 9Router: Tạo Bot Zalo AI Tự Động Từ A-Z" width="300"/>
+      </a><br/>
+      <b>🇻🇳 Tiếng Việt</b><br/>
+      <sub>Hướng Dẫn Setup OpenClaw + 9Router: Tạo Bot Zalo AI Tự Động Từ A-Z<br/>by <a href="https://github.com/tuanminhhole">tuanminhhole</a></sub>
+    </td>
+    <td align="center" width="320"></td>
+    <td align="center" width="320"></td>
+    <td align="center" width="320"></td>
+  </tr>
+</table>
+
+</div>
+
+> 🎬 **Made a video about 9Router?** Submit a [Pull Request](https://github.com/decolua/9router/pulls) adding your video to this section — we'll merge it!
+
+---
+
+## 🛠️ Supported CLI Tools
+
+9Router works seamlessly with all major AI coding tools:
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center" width="120">
+        <img src="./public/providers/claude.png" width="60" alt="Claude Code"/><br/>
+        <b>Claude-Code</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/openclaw.png" width="60" alt="OpenClaw"/><br/>
+        <b>OpenClaw</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/codex.png" width="60" alt="Codex"/><br/>
+        <b>Codex</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/opencode.png" width="60" alt="OpenCode"/><br/>
+        <b>OpenCode</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/cursor.png" width="60" alt="Cursor"/><br/>
+        <b>Cursor</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/antigravity.png" width="60" alt="Antigravity"/><br/>
+        <b>Antigravity</b>
+      </td>
+    </tr>
+    <tr>
+      <td align="center" width="120">
+        <img src="./public/providers/cline.png" width="60" alt="Cline"/><br/>
+        <b>Cline</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/continue.png" width="60" alt="Continue"/><br/>
+        <b>Continue</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/droid.png" width="60" alt="Droid"/><br/>
+        <b>Droid</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/roo.png" width="60" alt="Roo"/><br/>
+        <b>Roo</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/copilot.png" width="60" alt="Copilot"/><br/>
+        <b>Copilot</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/kilocode.png" width="60" alt="Kilo Code"/><br/>
+        <b>Kilo Code</b>
+      </td>
+    </tr>
+    <tr>
+      <td align="center" width="120">
+        <img src="./public/providers/opendesign.png" width="60" alt="OpenDesign"/><br/>
+        <b>OpenDesign</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/jcode.png" width="60" alt="jcode"/><br/>
+        <b>jcode</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/grok-cli.png" width="60" alt="Grok Build"/><br/>
+        <b>Grok Build</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/devin-cli.png" width="60" alt="Devin CLI"/><br/>
+        <b>Devin CLI</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/deepseek-tui.png" width="60" alt="DeepSeek TUI"/><br/>
+        <b>DeepSeek TUI</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/qwen.png" width="60" alt="Qwen Code"/><br/>
+        <b>Qwen Code</b>
+      </td>
+    </tr>
+  </table>
+</div>
+
+---
+
+## 🌐 Supported Providers
+
+### 🔐 OAuth Providers
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center" width="120">
+        <img src="./public/providers/claude.png" width="60" alt="Claude Code"/><br/>
+        <b>Claude-Code</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/antigravity.png" width="60" alt="Antigravity"/><br/>
+        <b>Antigravity</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/codex.png" width="60" alt="Codex"/><br/>
+        <b>Codex</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/github.png" width="60" alt="GitHub"/><br/>
+        <b>GitHub</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/cursor.png" width="60" alt="Cursor"/><br/>
+        <b>Cursor</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/kimchi.png" width="60" alt="Kimchi"/><br/>
+        <b>Kimchi</b>
+      </td>
+    </tr>
+  </table>
+</div>
+
+### 🆓 Free Providers
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center" width="150">
+        <img src="./public/providers/kiro.png" width="70" alt="Kiro"/><br/>
+        <b>Kiro AI</b><br/>
+        <sub>Claude 4.5 + GLM-5 + MiniMax<br/>50 credits/month free</sub>
+      </td>
+      <td align="center" width="150">
+        <img src="./public/providers/opencode.png" width="70" alt="OpenCode Free"/><br/>
+        <b>OpenCode Free</b><br/>
+        <sub>No auth • Auto-fetch models<br/>Free (model list varies)</sub>
+      </td>
+      <td align="center" width="150">
+        <img src="./public/providers/gemini.png" width="70" alt="Vertex AI"/><br/>
+        <b>Vertex AI</b><br/>
+        <sub>Gemini 3 Pro + GLM-5 + DeepSeek<br/>$300 credits free</sub>
+      </td>
+    </tr>
+  </table>
+</div>
+
+> **Note:** iFlow, Qwen Code and Gemini CLI free tiers were discontinued in 2026. Use Kiro / OpenCode Free / Vertex instead.
+>
+> **Kiro AI** moved to a paid model in Sep 2025 — the free tier is now capped at **50 credits/month** (plus 500 trial credits for new accounts in the first 30 days). Paid tiers: Pro $20/mo (1,000 credits), Pro+ $40/mo (2,000), Pro Max $100/mo (5,000), Power $200/mo (10,000).
+> **OpenCode Free** model list fluctuates over time (some models free only for limited promos) — subject to change without notice.
+> **Vertex AI**: the $300 free credit for new GCP accounts is still valid, but since Mar 2026 the **Gemini API endpoint no longer consumes these credits** — call the **Vertex AI Studio** endpoint instead.
+
+### 🔑 API Key Providers (40+)
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center" width="100">
+        <img src="./public/providers/openrouter.png" width="50" alt="OpenRouter"/><br/>
+        <sub>OpenRouter</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/glm.png" width="50" alt="GLM"/><br/>
+        <sub>GLM</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/kimi.png" width="50" alt="Kimi"/><br/>
+        <sub>Kimi</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/minimax.png" width="50" alt="MiniMax"/><br/>
+        <sub>MiniMax</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/openai.png" width="50" alt="OpenAI"/><br/>
+        <sub>OpenAI</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/anthropic.png" width="50" alt="Anthropic"/><br/>
+        <sub>Anthropic</sub>
+      </td>
+    </tr>
+    <tr>
+      <td align="center" width="100">
+        <img src="./public/providers/gemini.png" width="50" alt="Gemini"/><br/>
+        <sub>Gemini</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/deepseek.png" width="50" alt="DeepSeek"/><br/>
+        <sub>DeepSeek</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/groq.png" width="50" alt="Groq"/><br/>
+        <sub>Groq</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/xai.png" width="50" alt="xAI"/><br/>
+        <sub>xAI</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/mistral.png" width="50" alt="Mistral"/><br/>
+        <sub>Mistral</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/perplexity.png" width="50" alt="Perplexity"/><br/>
+        <sub>Perplexity</sub>
+      </td>
+    </tr>
+    <tr>
+      <td align="center" width="100">
+        <img src="./public/providers/together.png" width="50" alt="Together"/><br/>
+        <sub>Together AI</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/fireworks.png" width="50" alt="Fireworks"/><br/>
+        <sub>Fireworks</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/cerebras.png" width="50" alt="Cerebras"/><br/>
+        <sub>Cerebras</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/cohere.png" width="50" alt="Cohere"/><br/>
+        <sub>Cohere</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/nvidia.png" width="50" alt="NVIDIA"/><br/>
+        <sub>NVIDIA</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/siliconflow.png" width="50" alt="SiliconFlow"/><br/>
+        <sub>SiliconFlow</sub>
+      </td>
+    </tr>
+  </table>
+  <p><i>...and 20+ more providers including Nebius, Chutes, Hyperbolic, and custom OpenAI/Anthropic compatible endpoints</i></p>
+</div>
+
+### 🏠 Self-hosted Providers
+
+For speech and embeddings served from **your own** machine — whisper.cpp,
+faster-whisper, Speaches, Kokoro-FastAPI, openedai-speech, llama.cpp/llama-server,
+vLLM, Infinity, text-embeddings-inference, or anything else that speaks the OpenAI
+shape.
+
+| Provider | Endpoint used | Typical server |
+| --- | --- | --- |
+| **Self-hosted STT** | `/v1/audio/transcriptions` | whisper.cpp, faster-whisper |
+| **Self-hosted TTS** | `/v1/audio/speech` | Kokoro-FastAPI, openedai-speech |
+| **Self-hosted Embedding** | `/v1/embeddings` | llama-server, vLLM, Infinity |
+
+Every other speech provider is a named cloud service with a fixed endpoint. These
+three read their address from **each connection**, so one provider can front
+several machines and load-balance across them like any other.
+
+Set it on the connection as `providerSpecificData.baseUrl`:
+
+| Provider | Give it | Result |
+| --- | --- | --- |
+| Self-hosted STT | the full URL — `http://host:8080/v1/audio/transcriptions` | used as-is |
+| Self-hosted TTS | the server root — `http://host:8880` | `+ /v1/audio/speech` |
+| Self-hosted Embedding | the **OpenAI base**, `/v1` included — `http://host:8080/v1` | `+ /embeddings` |
+
+> **Mind the `/v1` on embeddings.** The adapter appends `/embeddings`, so
+> `http://host:8080` resolves to `http://host:8080/embeddings` and misses the
+> OpenAI route — llama-server answers **501**. Give it the same base URL an OpenAI
+> client would use. A full `.../v1/embeddings` is also accepted, so a value pasted
+> from a `curl` example works too.
+
+The API key is not checked by most local servers, but the field must be non-empty:
+it is what gives the connection a credentials record, and `baseUrl` lives there.
+Any placeholder works.
+
+Self-hosted Embedding has **no cloud fallback by design** — a connection saved
+without a `baseUrl` is reported as a configuration error rather than quietly
+falling back to `api.openai.com`, which would send your input text and API key to
+a third party under a provider named "Self-hosted".
+
+---
+
+## 💡 Key Features
+
+| Feature                                                                           | What It Does                                                                             | Why It Matters                                    |
+| --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------- |
+| 🚀 **RTK Token Saver** ([RTK](https://github.com/rtk-ai/rtk) ⭐40K)               | Compress tool outputs (`git diff`, `grep`, `ls`, `tree`...) before sending to LLM        | Save **20-40% input tokens** per request          |
+| 🧠 **Headroom Token Saver** ([Headroom](https://github.com/chopratejas/headroom)) | Optional external `/v1/compress` proxy before provider routing                           | Save more context tokens without changing clients |
+| 🪨 **Caveman Mode** ([Caveman](https://github.com/JuliusBrussee/caveman) ⭐52K)   | Inject caveman-speak prompt → LLM replies terse, technical substance preserved           | Save **up to 65% output tokens**                  |
+| 🐴 **Ponytail** ([Ponytail](https://github.com/DietrichGebert/ponytail))          | Inject "lazy senior dev" prompt → LLM writes minimal, YAGNI-first code (Lite/Full/Ultra) | **Fewer output tokens, less refactoring**         |
+| 🎯 **Smart 3-Tier Fallback**                                                      | Auto-route: Subscription → Cheap → Free                                                  | Never stop coding, zero downtime                  |
+| 📊 **Real-Time Quota Tracking**                                                   | Live token count + reset countdown                                                       | Maximize subscription value                       |
+| 🔄 **Format Translation**                                                         | OpenAI ↔ Claude ↔ Gemini ↔ Cursor ↔ Kiro ↔ Vertex                                        | Works with any CLI tool                           |
+| 👥 **Multi-Account Support**                                                      | Multiple accounts per provider                                                           | Load balancing + redundancy                       |
+| 🔄 **Auto Token Refresh**                                                         | OAuth tokens refresh automatically                                                       | No manual re-login needed                         |
+| 🎨 **Custom Combos**                                                              | Create unlimited model combinations                                                      | Tailor fallback to your needs                     |
+| 📝 **Request Logging**                                                            | Debug mode with full request/response logs                                               | Troubleshoot issues easily                        |
+| 💾 **Cloud Sync**                                                                 | Sync config across devices                                                               | Same setup everywhere                             |
+| 📊 **Usage Analytics**                                                            | Track tokens, cost, trends over time                                                     | Optimize spending                                 |
+| 🌐 **Deploy Anywhere**                                                            | Localhost, VPS, Docker, Cloudflare Workers                                               | Flexible deployment options                       |
+
+Set `X-9Router-Token-Saver: off` to bypass all token savers for one chat request.
+
+<details>
+<summary><b>📖 Feature Details</b></summary>
+
+### 🚀 RTK Token Saver
+
+Tool outputs (`git diff`, `grep`, `find`, `ls`, `tree`, log dumps...) often eat 30-50% of your prompt budget. RTK detects them and applies smart, lossless compression **before** the request hits the LLM:
+
+- **Filters:** `git-diff`, `git-status`, `grep`, `find`, `ls`, `tree`, `dedup-log`, `smart-truncate`, `read-numbered`, `search-list`
+- **Auto-detect:** No config needed — RTK peeks the first 1KB of each `tool_result` and picks the right filter.
+- **Safe by design:** If a filter fails, throws, or makes output bigger, RTK silently keeps the original text. Errors never break your request.
+- **Universal:** Works across all formats (OpenAI, Claude, Gemini, Cursor, Kiro, OpenAI Responses) because it runs **before** any format translation.
+- **Default ON:** Toggle anytime in Dashboard → Endpoint settings.
+
+```
+Without RTK: 47K tokens sent to LLM
+With RTK:    28K tokens sent to LLM   (40% saved · same context · same answer)
+```
+
+### 🧠 Headroom Token Saver
+
+Headroom is optional and runs separately. 9Router calls Headroom's local `/v1/compress` endpoint, then keeps normal routing, fallback, auth, and usage tracking:
+
+```
+Client → 9Router → Headroom /v1/compress → 9Router → provider
+```
+
+Local setup:
+
+```bash
+pip install "headroom-ai[proxy]"
+headroom proxy --port 8787
+```
+
+Enable in Dashboard → Endpoint → Token Saver → Headroom. Default URL: `http://localhost:8787`.
+
+Docker examples:
+
+```bash
+# Headroom service in same Docker network
+http://headroom:8787
+
+# Headroom running on host machine
+http://host.docker.internal:8787
+```
+
+If Headroom is down or returns an error, 9Router fails open and sends the original request.
+
+### 🐴 Ponytail (Lazy Senior Dev)
+
+Ponytail injects a _"lazy senior dev"_ system prompt into every request, biasing the LLM toward minimal, YAGNI-first code — deletion over addition, stdlib over new deps, one-liners over abstractions. Adapted from [DietrichGebert/ponytail](https://github.com/DietrichGebert/ponytail).
+
+- **Lite** — Build what's asked, name the lazier alternative.
+- **Full** — YAGNI ladder enforced: stdlib → native → existing deps → one-liner → minimal code.
+- **Ultra** — YAGNI extremist: deletion first, ship the one-liner, challenge the rest of the requirement in the same response.
+
+```
+Without Ponytail: verbose code, extra abstractions, "just in case" scaffolding
+With Ponytail:    shortest working diff, no unrequested abstractions, fewer tokens
+```
+
+Never trades away: input validation, error handling that prevents data loss, security, accessibility, or anything explicitly requested. Enable in Dashboard → Endpoint → Ponytail. Stacks with Caveman (output terseness) and RTK (input compression).
+
+### 🎯 Smart 3-Tier Fallback
+
+Create combos with automatic fallback:
+
+```
+Combo: "my-coding-stack"
+  1. cc/claude-opus-4-6        (your subscription)
+  2. glm/glm-4.7               (cheap backup, $0.6/1M)
+  3. if/kimi-k2-thinking       (free fallback)
+
+→ Auto switches when quota runs out or errors occur
+```
+
+### 📊 Real-Time Quota Tracking
+
+- Token consumption per provider
+- Reset countdown (5-hour, daily, weekly)
+- Cost estimation for paid tiers
+- Monthly spending reports
+
+### 🔄 Format Translation
+
+Seamless translation between formats:
+
+- **OpenAI** ↔ **Claude** ↔ **Gemini** ↔ **Cursor** ↔ **Kiro** ↔ **Vertex** ↔ **Antigravity** ↔ **Ollama** ↔ **OpenAI Responses**
+- Your CLI tool sends OpenAI format → 9Router translates → Provider receives native format
+- Works with any tool that supports custom OpenAI endpoints
+
+### 👥 Multi-Account Support
+
+- Add multiple accounts per provider
+- Auto round-robin or priority-based routing
+- Fallback to next account when one hits quota
+
+### 🔄 Auto Token Refresh
+
+- OAuth tokens automatically refresh before expiration
+- No manual re-authentication needed
+- Seamless experience across all providers
+
+### 🎨 Custom Combos
+
+- Create unlimited model combinations
+- Mix subscription, cheap, and free tiers
+- Name your combos for easy access
+- Share combos across devices with Cloud Sync
+
+### 📝 Request Logging
+
+- Enable debug mode for full request/response logs
+- Track API calls, headers, and payloads
+- Troubleshoot integration issues
+- Export logs for analysis
+
+### 💾 Cloud Sync
+
+- Sync providers, combos, and settings across devices
+- Automatic background sync
+- Secure encrypted storage
+- Access your setup from anywhere
+
+#### Cloud Runtime Notes
+
+- Prefer server-side cloud variables in production:
+  - `BASE_URL` (internal callback URL used by sync scheduler)
+  - `CLOUD_URL` (cloud sync endpoint base)
+- `NEXT_PUBLIC_BASE_URL` and `NEXT_PUBLIC_CLOUD_URL` are still supported for compatibility/UI, but server runtime now prioritizes `BASE_URL`/`CLOUD_URL`.
+- Cloud sync requests now use timeout + fail-fast behavior to avoid UI hanging when cloud DNS/network is unavailable.
+
+### 📊 Usage Analytics
+
+- Track token usage per provider and model
+- Cost estimation and spending trends
+- Monthly reports and insights
+- Optimize your AI spending
+
+> **💡 IMPORTANT - Understanding Dashboard Costs:**
+>
+> The "cost" displayed in Usage Analytics is **for tracking and comparison purposes only**.
+> 9Router itself **never charges** you anything. You only pay providers directly (if using paid services).
+>
+> **Example:** If your dashboard shows "$290 total cost" while using Kiro free models, this represents
+> what you would have paid using paid APIs directly. Your actual cost = **$0** (Kiro free tier: ~50 credits/mo).
+>
+> Think of it as a "savings tracker" showing how much you're saving by using free models or
+> routing through 9Router!
+
+### 🌐 Deploy Anywhere
+
+- 💻 **Localhost** - Default, works offline
+- ☁️ **VPS/Cloud** - Share across devices
+- 🐳 **Docker** - One-command deployment
+- 🚀 **Cloudflare Workers** - Global edge network
+
+</details>
+
+---
+
+## 💰 Pricing at a Glance
+
+| Tier                | Provider              | Cost         | Quota Reset      | Best For                                |
+| ------------------- | --------------------- | ------------ | ---------------- | --------------------------------------- |
+| **🚀 TOKEN SAVER**  | **RTK (built-in)**    | **FREE**     | Always on        | **Save 20-40% tokens on EVERY request** |
+| **💳 SUBSCRIPTION** | Claude Code (Pro/Max) | $20-200/mo   | 5h + weekly      | Already subscribed                      |
+|                     | Codex (Plus/Pro)      | $20-200/mo   | 5h + weekly      | OpenAI users                            |
+|                     | GitHub Copilot        | $10-19/mo    | Monthly          | GitHub users                            |
+|                     | Cursor IDE            | $20/mo       | Monthly          | Cursor users                            |
+| **💰 CHEAP**        | GLM-5.1 / GLM-4.7     | $0.6/1M      | Daily 10AM       | Budget backup                           |
+|                     | MiniMax M2.7          | $0.2/1M      | 5-hour rolling   | Cheapest option                         |
+|                     | Kimi K2.5             | $9/mo flat   | 10M tokens/mo    | Predictable cost                        |
+ | **🆓 FREE**         | Kiro AI               | $0           | 50 credits/mo    | Claude 4.5 + GLM-5 + MiniMax free (paid tiers above) |
+ |                     | OpenCode Free         | $0           | Varies*          | No auth, auto-fetch models (list changes over time) |
+ |                     | Vertex AI             | $300 credits | New GCP accounts | Gemini 3 Pro + DeepSeek + GLM-5 (use Vertex AI Studio endpoint for free credits) |
+
+**💡 Pro Tip:** RTK + Kiro AI + OpenCode Free combo = **$0 cost + 20-40% token savings**!
+
+---
+
+### 📊 Understanding 9Router Costs & Billing
+
+**9Router Billing Reality:**
+
+✅ **9Router software = FREE forever** (open source, never charges)  
+✅ **Dashboard "costs" = Display/tracking only** (not actual bills)  
+✅ **You pay providers directly** (subscriptions or API fees)  
+✅ **FREE providers stay FREE** (Kiro ~50 credits/mo, OpenCode Free, Vertex $300 credits = $0 within free-tier limits) — note iFlow/Qwen/Gemini CLI free tiers were discontinued in 2026
+❌ **9Router never sends invoices** or charges your card
+
+**How Cost Display Works:**
+
+The dashboard shows **estimated costs** as if you were using paid APIs directly. This is **not billing** - it's a comparison tool to show your savings.
+
+**Example Scenario:**
+
+```
+Dashboard Display:
+• Total Requests: 1,662
+• Total Tokens: 47M
+• Display Cost: $290
+
+Reality Check:
+• Provider: Kiro (free tier: ~50 credits/mo)
+• Actual Payment: $0.00
+• What $290 Means: Amount you SAVED by using free models!
+```
+
+**Payment Rules:**
+
+- **Subscription providers** (Claude Code, Codex): Pay them directly via their websites
+- **Cheap providers** (GLM, MiniMax): Pay them directly, 9Router just routes
+- **FREE providers** (iFlow, Kiro, Qwen): Genuinely free forever, no hidden charges
+- **9Router**: Never charges anything, ever
+
+---
+
+## 🎯 Use Cases
+
+### Case 1: "I have Claude Pro subscription"
+
+**Problem:** Quota expires unused, rate limits during heavy coding
+
+**Solution:**
+
+```
+Combo: "maximize-claude"
+  1. cc/claude-opus-4-7        (use subscription fully)
+  2. glm/glm-5.1               (cheap backup when quota out)
+  3. kr/claude-sonnet-4.5      (free emergency fallback)
+
+Monthly cost: $20 (subscription) + ~$5 (backup) = $25 total
+vs. $20 + hitting limits = frustration
+```
+
+### Case 2: "I want zero cost"
+
+**Problem:** Can't afford subscriptions, need reliable AI coding
+
+**Solution:**
+
+```
+Combo: "free-forever"
+  1. kr/claude-sonnet-4.5      (Claude 4.5 free via Kiro, ~50 credits/mo)
+  2. kr/glm-5                  (GLM-5 free via Kiro)
+  3. oc/<auto>                 (OpenCode Free, no auth)
+
+Monthly cost: $0
+Quality: Production-ready models + RTK saves 20-40% tokens
+```
+
+### Case 3: "I need 24/7 coding, no interruptions"
+
+**Problem:** Deadlines, can't afford downtime
+
+**Solution:**
+
+```
+Combo: "always-on"
+  1. cc/claude-opus-4-7        (best quality)
+  2. cx/gpt-5.5                (second subscription)
+  3. glm/glm-5.1               (cheap, resets daily)
+  4. minimax/MiniMax-M2.7      (cheapest, 5h reset)
+  5. kr/claude-sonnet-4.5      (free via Kiro, ~50 credits/mo)
+
+Result: 5 layers of fallback = zero downtime
+Monthly cost: $20-200 (subscriptions) + $10-20 (backup)
+```
+
+### Case 4: "I want FREE AI in OpenClaw"
+
+**Problem:** Need AI assistant in messaging apps (WhatsApp, Telegram, Slack...), completely free
+
+**Solution:**
+
+```
+Combo: "openclaw-free"
+  1. kr/claude-sonnet-4.5      (Claude 4.5 free)
+  2. kr/glm-5                  (GLM-5 free)
+  3. kr/MiniMax-M2.5           (MiniMax free)
+
+Monthly cost: $0
+Access via: WhatsApp, Telegram, Slack, Discord, iMessage, Signal...
+```
+
+---
+
+## ❓ Frequently Asked Questions
+
+<details>
+<summary><b>📊 Why does my dashboard show high costs?</b></summary>
+
+The dashboard tracks your token usage and displays **estimated costs** as if you were using paid APIs directly. This is **not actual billing** - it's a reference to show how much you're saving by using free models or existing subscriptions through 9Router.
+
+**Example:**
+
+- **Dashboard shows:** "$290 total cost"
+- **Reality:** You're using Kiro free models (~50 credits/mo)
+- **Your actual cost:** **$0.00**
+- **What $290 means:** Amount you **saved** by using free models instead of paid APIs!
+
+The cost display is a "savings tracker" to help you understand your usage patterns and optimization opportunities.
+
+</details>
+
+<details>
+<summary><b>💳 Will I be charged by 9Router?</b></summary>
+
+**No.** 9Router is free, open-source software that runs on your own computer. It never charges you anything.
+
+**You only pay:**
+
+- ✅ **Subscription providers** (Claude Code $20/mo, Codex $20-200/mo) → Pay them directly on their websites
+- ✅ **Cheap providers** (GLM, MiniMax) → Pay them directly, 9Router just routes your requests
+- ❌ **9Router itself** → **Never charges anything, ever**
+
+9Router is a local proxy/router. It doesn't have your credit card, can't send invoices, and has no billing system. It's completely free software.
+
+</details>
+
+<details>
+<summary><b>🆓 Are FREE providers really unlimited?</b></summary>
+
+**Mostly!** The current FREE providers (Kiro, OpenCode Free, Vertex) are genuinely free, but free tiers have limits:
+
+These are free services offered by those respective companies:
+
+- **Kiro AI**: ~50 credits/month free (plus 500 trial credits for new accounts in the first 30 days) via AWS Builder ID / Google / GitHub OAuth. Paid tiers available above that.
+- **OpenCode Free**: No-auth passthrough proxy, models auto-fetched from `opencode.ai/zen/v1/models`. The free model list fluctuates over time (some models free only for limited promos) — subject to change without notice.
+- **Vertex AI**: $300 free credits for new Google Cloud accounts (90 days). Since Mar 2026 the Gemini API endpoint no longer consumes these credits — use the **Vertex AI Studio** endpoint instead.
+
+9Router just routes your requests to them - there's no "catch" or future billing from 9Router itself. They're truly free services, and 9Router makes them easy to use with fallback support.
+
+**Discontinued free tiers (no longer recommended):**
+
+- ❌ **iFlow**: Was free unlimited, now changed to paid (2026)
+- ❌ **Qwen Code**: Free OAuth tier fully discontinued by Alibaba on 2026-04-15
+- ❌ **Gemini CLI**: Service fully shut down by Google on 2026-06-18 (replaced by the closed-source Antigravity CLI). Discontinued — do not use.
+
+</details>
+
+<details>
+<summary><b>💰 How do I minimize my actual AI costs?</b></summary>
+
+**Free-First Strategy:**
+
+1. **Start with 100% free combo:**
+
+   ```
+   1. kr/glm-5 (GLM-5 free via Kiro, ~50 credits/mo)
+   2. OpenCode Free models (no auth, auto-fetched)
+   3. Vertex AI Gemini 3 Pro (using the Vertex AI Studio endpoint with $300 credits)
+   ```
+
+   **Cost: $0/month** (within Kiro's free credit cap; OpenCode/Vertex subject to their free-tier limits)
+
+2. **Add cheap backup** only if you need it:
+
+   ```
+   4. glm/glm-4.7 ($0.6/1M tokens)
+   ```
+
+   **Additional cost: Only pay for what you actually use**
+
+3. **Use subscription providers last:**
+   - Only if you already have them
+   - 9Router helps maximize their value through quota tracking
+
+**Result:** Most users can operate at $0/month using only free tiers!
+
+</details>
+
+<details>
+<summary><b>📈 What if my usage suddenly spikes?</b></summary>
+
+9Router's smart fallback prevents surprise charges:
+
+**Scenario:** You're on a coding sprint and blow through your quotas
+
+**Without 9Router:**
+
+- ❌ Hit rate limit → Work stops → Frustration
+- ❌ Or: Accidentally rack up huge API bills
+
+**With 9Router:**
+
+- ✅ Subscription hits limit → Auto-fallback to cheap tier
+- ✅ Cheap tier gets expensive → Auto-fallback to free tier
+- ✅ Never stop coding → Predictable costs
+
+**You're in control:** Set spending limits per provider in dashboard, and 9Router respects them.
+
+</details>
+
+---
+
+## 📖 Setup Guide
+
+<details>
+<summary><b>🔐 Subscription Providers (Maximize Value)</b></summary>
+
+### Claude Code (Pro/Max)
+
+```bash
+Dashboard → Providers → Connect Claude Code
+→ OAuth login → Auto token refresh
+→ 5-hour + weekly quota tracking
+
+Models:
+  cc/claude-opus-4-7
+  cc/claude-opus-4-6
+  cc/claude-sonnet-4-6
+  cc/claude-haiku-4-5-20251001
+```
+
+**Pro Tip:** Use Opus for complex tasks, Sonnet for speed. 9Router tracks quota per model!
+
+### OpenAI Codex (Plus/Pro)
+
+```bash
+Dashboard → Providers → Connect Codex
+→ OAuth login (port 1455)
+→ 5-hour + weekly reset
+
+Models:
+  cx/gpt-5.5
+  cx/gpt-5.4
+  cx/gpt-5.3-codex
+  cx/gpt-5.2-codex
+```
+
+### GitHub Copilot
+
+```bash
+Dashboard → Providers → Connect GitHub
+→ OAuth via GitHub
+→ Monthly reset (1st of month)
+
+Models:
+  gh/gpt-5.4
+  gh/claude-opus-4.7
+  gh/claude-sonnet-4.6
+  gh/gemini-3.1-pro-preview
+  gh/grok-code-fast-1
+```
+
+### Cursor IDE
+
+```bash
+Dashboard → Providers → Connect Cursor
+→ OAuth login
+→ Monthly subscription
+
+Models:
+  cu/claude-4.6-opus-max
+  cu/claude-4.5-sonnet-thinking
+  cu/gpt-5.3-codex
+```
+
+</details>
+
+<details>
+<summary><b>💰 Cheap Providers (Backup)</b></summary>
+
+### GLM-5.1 / GLM-4.7 (Daily reset, $0.6/1M)
+
+1. Sign up: [Zhipu AI](https://open.bigmodel.cn/)
+2. Get API key from Coding Plan
+3. Dashboard → Add API Key:
+   - Provider: `glm`
+   - API Key: `your-key`
+
+**Use:** `glm/glm-5.1`, `glm/glm-5`, `glm/glm-4.7`
+
+**Pro Tip:** Coding Plan offers 3× quota at 1/7 cost! Reset daily 10:00 AM.
+
+### MiniMax M2.7 (5h reset, $0.20/1M)
+
+1. Sign up: [MiniMax](https://www.minimax.io/)
+2. Get API key
+3. Dashboard → Add API Key
+
+**Use:** `minimax/MiniMax-M2.7`, `minimax/MiniMax-M2.5`
+
+**Pro Tip:** Cheapest option for long context (1M tokens)!
+
+### Kimi K2.5 ($9/month flat)
+
+1. Subscribe: [Moonshot AI](https://platform.moonshot.ai/)
+2. Get API key
+3. Dashboard → Add API Key
+
+**Use:** `kimi/kimi-k2.5`, `kimi/kimi-k2.5-thinking`
+
+**Pro Tip:** Fixed $9/month for 10M tokens = $0.90/1M effective cost!
+
+</details>
+
+<details>
+<summary><b>🆓 FREE Providers (Recommended)</b></summary>
+
+### Kiro AI (Claude 4.5 + GLM-5 + MiniMax FREE)
+
+```bash
+Dashboard → Connect Kiro
+→ AWS Builder ID, AWS IAM Identity Center, Google, or GitHub
+→ Unlimited usage
+
+Models:
+  kr/claude-sonnet-4.5
+  kr/claude-haiku-4.5
+  kr/glm-5
+  kr/MiniMax-M2.5
+  kr/qwen3-coder-next
+  kr/deepseek-3.2
+```
+
+**Pro Tip:** Best free option for Claude. No API key, no payment, fully unlimited.
+
+### OpenCode Free (No auth, auto-fetch models)
+
+```bash
+Dashboard → Connect OpenCode Free
+→ No login required (passthrough proxy)
+→ Models auto-fetched from opencode.ai/zen/v1/models
+```
+
+**Pro Tip:** Fastest setup. Just connect and start coding.
+
+### Vertex AI ($300 free credits for new GCP accounts)
+
+```bash
+Dashboard → Connect Vertex AI
+→ Upload Google Cloud Service Account JSON
+→ Enable Vertex AI API in your GCP project
+
+Models:
+  vertex/gemini-3.1-pro-preview
+  vertex/gemini-3-flash-preview
+  vertex/gemini-2.5-flash
+
+Vertex Partner (Anthropic / DeepSeek / GLM / Qwen via Vertex):
+  vertex-partner/glm-5-maas
+  vertex-partner/deepseek-v3.2-maas
+  vertex-partner/qwen3-next-80b-a3b-thinking-maas
+```
+
+**Pro Tip:** New Google Cloud accounts get $300 credits free for 90 days. Plenty for daily coding.
+
+</details>
+
+<details>
+<summary><b>🎨 Create Combos</b></summary>
+
+### Example 1: Maximize Subscription → Cheap Backup
+
+```
+Dashboard → Combos → Create New
+
+Name: premium-coding
+Models:
+  1. cc/claude-opus-4-7 (Subscription primary)
+  2. glm/glm-5.1 (Cheap backup, $0.6/1M)
+  3. minimax/MiniMax-M2.7 (Cheapest fallback, $0.20/1M)
+
+Use in CLI: premium-coding
+
+Monthly cost example (100M tokens):
+  80M via Claude (subscription): $0 extra
+  15M via GLM: $9
+  5M via MiniMax: $1
+  Total: $10 + your subscription
+```
+
+### Example 2: Free-Only (Zero Cost)
+
+```
+Name: free-combo
+Models:
+  1. kr/claude-sonnet-4.5 (Claude 4.5 free via Kiro, ~50 credits/mo)
+  2. kr/glm-5 (GLM-5 free via Kiro)
+  3. vertex/gemini-3.1-pro-preview ($300 free credits)
+
+Cost: $0 forever (+ 20-40% token savings via RTK)!
+```
+
+</details>
+
+<details>
+<summary><b>🔧 CLI Integration</b></summary>
+
+### Cursor IDE
+
+```
+Settings → Models → Advanced:
+  OpenAI API Base URL: http://localhost:20128/v1
+  OpenAI API Key: [from 9router dashboard]
+  Model: cc/claude-opus-4-7
+```
+
+Or use combo: `premium-coding`
+
+### Claude Code
+
+Edit `~/.claude/config.json`:
+
+```json
+{
+  "anthropic_api_base": "http://localhost:20128/v1",
+  "anthropic_api_key": "your-9router-api-key"
+}
+```
+
+### Codex CLI
+
+```bash
+export OPENAI_BASE_URL="http://localhost:20128"
+export OPENAI_API_KEY="your-9router-api-key"
+
+codex "your prompt"
+```
+
+### OpenClaw
+
+**Option 1 — Dashboard (recommended):**
+
+```
+Dashboard → CLI Tools → OpenClaw → Select Model → Apply
+```
+
+**Option 2 — Manual:** Edit `~/.openclaw/openclaw.json`:
+
+```json
+{
+  "agents": {
+    "defaults": {
+      "model": {
+        "primary": "9router/kr/claude-sonnet-4.5"
+      }
+    }
+  },
+  "models": {
+    "providers": {
+      "9router": {
+        "baseUrl": "http://127.0.0.1:20128/v1",
+        "apiKey": "sk_9router",
+        "api": "openai-completions",
+        "models": [
+          {
+            "id": "kr/claude-sonnet-4.5",
+            "name": "Claude Sonnet 4.5 (Kiro Free)"
+          }
+        ]
+      }
+    }
+  }
+}
+```
+
+> **Note:** OpenClaw only works with local 9Router. Use `127.0.0.1` instead of `localhost` to avoid IPv6 resolution issues.
+
+### Cline / Continue / RooCode
+
+```
+Provider: OpenAI Compatible
+Base URL: http://localhost:20128/v1
+API Key: [from dashboard]
+Model: cc/claude-opus-4-7
+```
+
+</details>
+
+<details>
+<summary><b>🚀 Deployment</b></summary>
+
+### VPS Deployment
+
+```bash
+# Clone and install
+git clone https://github.com/decolua/9router.git
+cd 9router
+npm install
+npm run build
+
+# Configure
+export JWT_SECRET="your-secure-secret-change-this"
+export INITIAL_PASSWORD="your-password"
+export DATA_DIR="/var/lib/9router"
+export PORT="20128"
+export HOSTNAME="0.0.0.0"
+export NODE_ENV="production"
+export NEXT_PUBLIC_BASE_URL="http://localhost:20128"
+export NEXT_PUBLIC_CLOUD_URL="https://9router.com"
+export API_KEY_SECRET="endpoint-proxy-api-key-secret"
+export MACHINE_ID_SALT="endpoint-proxy-salt"
+
+# Start
+npm run start
+
+# Or use PM2
+npm install -g pm2
+pm2 start npm --name 9router -- start
+pm2 save
+pm2 startup
+```
+
+### Docker
+
+Published images (multi-platform `linux/amd64` + `linux/arm64`):
+
+- Docker Hub: [`decolua/9router`](https://hub.docker.com/r/decolua/9router)
+- GHCR: [`ghcr.io/decolua/9router`](https://github.com/decolua/9router/pkgs/container/9router)
+
+**Quick start (use published image):**
+
+```bash
+docker run -d \
+  --name 9router \
+  -p 20128:20128 \
+  -v "$HOME/.9router:/app/data" \
+  -e DATA_DIR=/app/data \
+  decolua/9router:latest
+```
+
+→ Open http://localhost:20128
+
+**Build from source (dev):**
+
+```bash
+git clone https://github.com/decolua/9router.git
+cd 9router/app
+docker build -t 9router .
+docker run -d --name 9router -p 20128:20128 \
+  -v "$HOME/.9router:/app/data" -e DATA_DIR=/app/data 9router
+```
+
+**Container defaults:**
+
+- `PORT=20128`
+- `HOSTNAME=0.0.0.0`
+
+**Useful commands:**
+
+```bash
+docker logs -f 9router
+docker restart 9router
+docker stop 9router && docker rm 9router
+docker pull decolua/9router:latest   # update to latest
+```
+
+**Data persistence:** `$HOME/.9router/db/data.sqlite` on host ↔ `/app/data/db/data.sqlite` in container.
+
+### Environment Variables
+
+| Variable                                             | Default                                  | Description                                                                         |
+| ---------------------------------------------------- | ---------------------------------------- | ----------------------------------------------------------------------------------- |
+| `JWT_SECRET`                                         | Auto-generated (`~/.9router/jwt-secret`) | JWT signing secret for dashboard auth cookie (override to share across instances)   |
+| `INITIAL_PASSWORD`                                   | `123456`                                 | First login password when no saved hash exists                                      |
+| `DATA_DIR`                                           | `~/.9router`                             | Main app data location (SQLite at `$DATA_DIR/db/data.sqlite`)                       |
+| `PORT`                                               | framework default                        | Service port (`20128` in examples)                                                  |
+| `HOSTNAME`                                           | framework default                        | Bind host (Docker defaults to `0.0.0.0`)                                            |
+| `NODE_ENV`                                           | runtime default                          | Set `production` for deploy                                                         |
+| `BASE_URL`                                           | `http://localhost:20128`                 | Server-side internal base URL used by cloud sync jobs                               |
+| `CLOUD_URL`                                          | `https://9router.com`                    | Server-side cloud sync endpoint base URL                                            |
+| `NEXT_PUBLIC_BASE_URL`                               | `http://localhost:3000`                  | Backward-compatible/public base URL (prefer `BASE_URL` for server runtime)          |
+| `NEXT_PUBLIC_CLOUD_URL`                              | `https://9router.com`                    | Backward-compatible/public cloud URL (prefer `CLOUD_URL` for server runtime)        |
+| `API_KEY_SECRET`                                     | `endpoint-proxy-api-key-secret`          | HMAC secret for generated API keys                                                  |
+| `MACHINE_ID_SALT`                                    | `endpoint-proxy-salt`                    | Salt for stable machine ID hashing                                                  |
+| `ENABLE_REQUEST_LOGS`                                | `false`                                  | Enables request/response logs under `logs/`                                         |
+| `AUTH_COOKIE_SECURE`                                 | `false`                                  | Force `Secure` auth cookie (set `true` behind HTTPS reverse proxy)                  |
+| `REQUIRE_API_KEY`                                    | `false`                                  | Enforce Bearer API key on `/v1/*` routes (recommended for internet-exposed deploys) |
+| `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, `NO_PROXY` | empty                                    | Optional outbound proxy for upstream provider calls                                 |
+| `SEARXNG_URL`                                        | `http://localhost:8888/search`           | Endpoint for the built-in unauthenticated SearXNG web-search provider               |
+
+Notes:
+
+- Lowercase proxy variables are also supported: `http_proxy`, `https_proxy`, `all_proxy`, `no_proxy`.
+- `.env` is not baked into Docker image (`.dockerignore`); inject runtime config with `--env-file` or `-e`.
+- On Windows, `APPDATA` can be used for local storage path resolution.
+- `INSTANCE_NAME` appears in older docs/env templates, but is currently not used at runtime.
+
+### Runtime Files and Storage
+
+- Main app state: `${DATA_DIR}/db/data.sqlite` (SQLite — providers, combos, aliases, keys, settings, usage history)
+- Auto backups: `${DATA_DIR}/db/backups/`
+- Optional request/translator logs: `<repo>/logs/...` when `ENABLE_REQUEST_LOGS=true`
+- Both `${DATA_DIR}` and `~/.9router` resolve to the same location in a Docker container — the symlink `/root/.9router -> /app/data` is created at build time.
+
+</details>
+
+---
+
+## 📊 Available Models
+
+<details>
+<summary><b>View all available models</b></summary>
+
+**Claude Code (`cc/`)** - Pro/Max:
+
+- `cc/claude-opus-4-7`
+- `cc/claude-opus-4-6`
+- `cc/claude-sonnet-4-6`
+- `cc/claude-sonnet-4-5-20250929`
+- `cc/claude-haiku-4-5-20251001`
+
+**Codex (`cx/`)** - Plus/Pro:
+
+- `cx/gpt-5.5`
+- `cx/gpt-5.4`
+- `cx/gpt-5.3-codex`
+- `cx/gpt-5.2-codex`
+- `cx/gpt-5.1-codex-max`
+
+**GitHub Copilot (`gh/`)**:
+
+- `gh/gpt-5.4`
+- `gh/claude-opus-4.7`
+- `gh/claude-sonnet-4.6`
+- `gh/gemini-3.1-pro-preview`
+- `gh/grok-code-fast-1`
+
+**Cursor (`cu/`)** - Subscription:
+
+- `cu/claude-4.6-opus-max`
+- `cu/claude-4.5-sonnet-thinking`
+- `cu/gpt-5.3-codex`
+- `cu/kimi-k2.5`
+
+**GLM (`glm/`)** - $0.6/1M:
+
+- `glm/glm-5.1`
+- `glm/glm-5`
+- `glm/glm-4.7`
+
+**MiniMax (`minimax/`)** - $0.2/1M:
+
+- `minimax/MiniMax-M2.7`
+- `minimax/MiniMax-M2.5`
+
+**Kimi (`kimi/`)** - $9/mo flat:
+
+- `kimi/kimi-k2.5`
+- `kimi/kimi-k2.5-thinking`
+
+**Kiro (`kr/`)** - Free (~50 credits/month, paid tiers above):
+
+- `kr/claude-sonnet-4.5`
+- `kr/claude-haiku-4.5`
+- `kr/glm-5`
+- `kr/MiniMax-M2.5`
+- `kr/qwen3-coder-next`
+- `kr/deepseek-3.2`
+
+**OpenCode Free (`oc/`)** - FREE no-auth:
+
+- Auto-fetched from `opencode.ai/zen/v1/models`
+
+**Vertex AI (`vertex/`)** - $300 free credits:
+
+- `vertex/gemini-3.1-pro-preview`
+- `vertex/gemini-3-flash-preview`
+- `vertex/gemini-2.5-flash`
+- `vertex-partner/glm-5-maas`
+- `vertex-partner/deepseek-v3.2-maas`
+
+</details>
+
+---
+
+## 🐛 Troubleshooting
+
+**"Language model did not provide messages"**
+
+- Provider quota exhausted → Check dashboard quota tracker
+- Solution: Use combo fallback or switch to cheaper tier
+
+**Rate limiting**
+
+- Subscription quota out → Fallback to GLM/MiniMax
+- Add combo: `cc/claude-opus-4-7 → glm/glm-5.1 → kr/claude-sonnet-4.5`
+
+**OAuth token expired**
+
+- Auto-refreshed by 9Router
+- If issues persist: Dashboard → Provider → Reconnect
+
+**High costs**
+
+- Enable RTK in Dashboard → Endpoint settings (default ON, saves 20-40% tokens)
+- Check usage stats in Dashboard
+- Switch primary model to GLM/MiniMax
+- Use free tier (Kiro, OpenCode Free, Vertex) for non-critical tasks
+
+**Dashboard opens on wrong port**
+
+- Set `PORT=20128` and `NEXT_PUBLIC_BASE_URL=http://localhost:20128`
+
+**First login not working**
+
+- Check `INITIAL_PASSWORD` in `.env`
+- If unset, fallback password is `123456`
+
+**No request logs under `logs/`**
+
+- Set `ENABLE_REQUEST_LOGS=true`
+
+---
+
+## 🛠️ Tech Stack
+
+- **Runtime**: Node.js 20+
+- **Framework**: Next.js 16
+- **UI**: React 19 + Tailwind CSS 4
+- **Database**: SQLite (better-sqlite3 / node:sqlite / sql.js fallback)
+- **Streaming**: Server-Sent Events (SSE)
+- **Auth**: OAuth 2.0 (PKCE) + JWT + API Keys
+
+---
+
+## 📝 API Reference
+
+### Chat Completions
+
+```bash
+POST http://localhost:20128/v1/chat/completions
+Authorization: Bearer your-api-key
+Content-Type: application/json
+
+{
+  "model": "cc/claude-opus-4-6",
+  "messages": [
+    {"role": "user", "content": "Write a function to..."}
+  ],
+  "stream": true
+}
+```
+
+### List Models
+
+```bash
+GET http://localhost:20128/v1/models
+Authorization: Bearer your-api-key
+
+→ Returns all models + combos in OpenAI format
+```
+
+## 📧 Support
+
+- **Website**: [9router.com](https://9router.com)
+- **GitHub**: [github.com/decolua/9router](https://github.com/decolua/9router)
+- **Issues**: [github.com/decolua/9router/issues](https://github.com/decolua/9router/issues)
+
+---
+
+## 👥 Contributors
+
+Thanks to all contributors who helped make 9Router better!
+
+[![Contributors](https://contrib.rocks/image?repo=decolua/9router&max=150&columns=15&anon=1&v=20260309)](https://github.com/decolua/9router/graphs/contributors)
+
+---
+
+## 📊 Star Chart
+
+[![Star Chart](https://starchart.cc/decolua/9router.svg?variant=adaptive)](https://starchart.cc/decolua/9router)
+
+## 🔀 Forks
+
+**[OmniRoute](https://github.com/diegosouzapw/OmniRoute)** — A full-featured TypeScript fork of 9Router. Adds 36+ providers, 4-tier auto-fallback, multi-modal APIs (images, embeddings, audio, TTS), circuit breaker, semantic cache, LLM evaluations, and a polished dashboard. 368+ unit tests. Available via npm and Docker.
+
+---
+
+## 🙏 Acknowledgments
+
+Built on the shoulders of giants:
+
+- **[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI)** — original Go implementation that inspired this JavaScript port.
+- **[RTK](https://github.com/rtk-ai/rtk)** ![Stars](https://img.shields.io/github/stars/rtk-ai/rtk?style=flat&color=yellow) — Rust token-saver. 9Router ports its compression pipeline to JS → **−20-40% input tokens** on every request.
+- **[Caveman](https://github.com/JuliusBrussee/caveman)** ![Stars](https://img.shields.io/github/stars/JuliusBrussee/caveman?style=flat&color=yellow) by **[@JuliusBrussee](https://github.com/JuliusBrussee)** — viral _"why use many token when few token do trick"_. 9Router adapts its prompt → **−65% output tokens**.
+- **[Ponytail](https://github.com/DietrichGebert/ponytail)** ![Stars](https://img.shields.io/github/stars/DietrichGebert/ponytail?style=flat&color=yellow) by **[@DietrichGebert](https://github.com/DietrichGebert)** — _"lazy senior dev"_ skill. 9Router injects its YAGNI-first ladder → **fewer tokens, less code, shorter diffs**.
+
+Huge thanks to these authors — without their work, 9Router's token-saving features wouldn't exist. ⭐ them on GitHub!
+
+---
+
+## 📄 License
+
+MIT License - see [LICENSE](LICENSE) for details.
+
+---
+
+<div align="center">
+  <sub>Built with ❤️ for developers who code 24/7</sub>
+</div>

README.zh-CN.md

@@ -0,0 +1,1315 @@
+
+<div align="center">
+  <img src="./images/9router.png?1" alt="9Router Dashboard" width="800"/>
+  
+  # 9Router - 免费 AI 路由器与 Token 节省器
+  
+  **编程永不停歇。使用 RTK + 自动切换到免费/低价 AI 模型，节省 20-40% 的 tokens。**
+  
+  **将所有 AI 编程工具（Claude Code、Cursor、Antigravity、Copilot、Codex、Gemini、OpenCode、Cline、OpenClaw...）连接到 40+ AI 提供商和 100+ 模型。**
+  
+  [![npm](https://img.shields.io/npm/v/9router.svg)](https://www.npmjs.com/package/9router)
+  [![Downloads](https://img.shields.io/npm/dm/9router.svg)](https://www.npmjs.com/package/9router)
+  [![License](https://img.shields.io/npm/l/9router.svg)](https://github.com/decolua/9router/blob/main/LICENSE)
+
+  <a href="https://trendshift.io/repositories/22628" target="_blank"><img src="https://trendshift.io/api/badge/repositories/22628" alt="decolua%2F9router | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
+  
+  [🚀 快速开始](#-快速开始) • [💡 功能特点](#-主要功能) • [📖 设置指南](#-设置指南) • [🌐 网站](https://9router.com)
+
+  [🇻🇳 Tiếng Việt](./i18n/README.vi.md) • [🇨🇳 中文](./i18n/README.zh-CN.md) • [🇯🇵 日本語](./i18n/README.ja-JP.md)
+</div>
+
+---
+
+## 🤔 为什么选择 9Router？
+
+**告别浪费金钱、tokens 和触碰限制的困扰：**
+
+- ❌ 订阅配额每月到期却未使用
+- ❌ 速率限制在编程中途打断你
+- ❌ 工具输出（git diff、grep、ls...）快速消耗 tokens
+- ❌ 昂贵的 API（每个提供商 $20-50/月）
+- ❌ 需要手动在提供商之间切换
+
+**9Router 解决这一切：**
+
+- ✅ **RTK Token 节省器** - 自动压缩 tool_result 内容，每次请求节省 20-40% tokens
+- ✅ **充分利用订阅** - 追踪配额，在重置前用尽每一分额度
+- ✅ **自动切换** - 订阅 → 低价 → 免费，零停机时间
+- ✅ **多账户支持** - 按提供商在账户之间轮询
+- ✅ **通用兼容** - 支持 Claude Code、Codex、Cursor、Cline 以及任何 CLI 工具
+
+---
+
+## 🔄 工作原理
+
+```
+┌─────────────┐
+│  你的 CLI   │  (Claude Code、Codex、OpenClaw、Cursor、Cline...)
+│   工具      │
+└──────┬──────┘
+       │ http://localhost:20128/v1
+       ↓
+┌─────────────────────────────────────────────┐
+│           9Router（智能路由器）              │
+│  • RTK Token 节省器（减少 tool_result tokens）│
+│  • 格式转换（OpenAI ↔ Claude）              │
+│  • 配额追踪                                  │
+│  • 自动刷新 token                           │
+└──────┬──────────────────────────────────────┘
+       │
+       ├─→ [第一层：订阅] Claude Code、Codex、GitHub Copilot
+       │   ↓ 配额耗尽
+       ├─→ [第二层：低价] GLM ($0.6/1M)、MiniMax ($0.2/1M)
+       │   ↓ 预算超限
+       └─→ [第三层：免费] Kiro、OpenCode Free、Vertex ($300 额度)
+
+结果：编程永不停歇，最小成本 + 通过 RTK 节省 20-40% tokens
+```
+
+---
+
+## ⚡ 快速开始
+
+**1. 全局安装：**
+
+```bash
+npm install -g 9router
+9router
+```
+
+🎉 控制面板在 `http://localhost:20128` 打开
+
+**2. 连接免费提供商（无需注册）：**
+
+控制面板 → 提供商 → 连接 **Kiro AI**（约 50 积分/月免费：Claude 4.5 + GLM-5 + MiniMax）或 **OpenCode Free**（无需认证）→ 完成！
+
+**3. 在 CLI 工具中使用：**
+
+```
+Claude Code/Codex/OpenClaw/Cursor/Cline 设置：
+  Endpoint: http://localhost:20128/v1
+  API Key: [从控制面板复制]
+  Model: kr/claude-sonnet-4.5
+```
+
+**就这么简单！** 开始使用免费 AI 模型编程。
+
+**替代方案：从源码运行（本仓库）：**
+
+本仓库的包是私有的（`9router-app`），所以源码/Docker 执行是预期的本地开发方式。
+
+```bash
+cp .env.example .env
+npm install
+PORT=20128 NEXT_PUBLIC_BASE_URL=http://localhost:20128 npm run dev
+```
+
+生产模式：
+
+```bash
+npm run build
+PORT=20128 HOSTNAME=0.0.0.0 NEXT_PUBLIC_BASE_URL=http://localhost:20128 npm run start
+```
+
+默认 URL：
+- 控制面板：`http://localhost:20128/dashboard`
+- OpenAI 兼容 API：`http://localhost:20128/v1`
+
+---
+
+## 视频教程
+
+<div align="center">
+
+<table>
+  <tr>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=raEyZPg5xE0">
+        <img src="https://img.youtube.com/vi/raEyZPg5xE0/maxresdefault.jpg" alt="9Router Setup Tutorial" width="300"/>
+      </a><br/>
+      <b>🇺🇸 English</b><br/>
+      <sub>9Router + Claude Code 免费设���<br/>by <a href="https://www.youtube.com/@BuildAIWithHamid">Build AI With Hamid</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=X69n5Lm06Yw">
+        <img src="https://img.youtube.com/vi/X69n5Lm06Yw/maxresdefault.jpg" alt="Tiết kiệm chi phí LLM với 9Router" width="300"/>
+      </a><br/>
+      <b>🇻🇳 Tiếng Việt</b><br/>
+      <sub>使用 9Router 节省 OpenClaw 的 LLM 成本<br/>by <a href="https://www.youtube.com/c/M%C3%ACAIblog">Mì AI</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=o3qYCyjrFYg">
+        <img src="https://img.youtube.com/vi/o3qYCyjrFYg/maxresdefault.jpg" alt="Claude Code FREE Forever" width="300"/>
+      </a><br/>
+      <b>🇺🇸 English</b><br/>
+      <sub>Claude Code 免费永久使用 — 无限模型<br/>by <a href="https://www.youtube.com/@BuildAIWithHamid">Build AI With Hamid</a></sub>
+    </td>
+  </tr>
+  <tr>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=Ttpc26m39Dw">
+        <img src="https://img.youtube.com/vi/Ttpc26m39Dw/maxresdefault.jpg" alt="Claude CLI Free Setup" width="300"/>
+      </a><br/>
+      <b>🇺🇸 English</b><br/>
+      <sub>使用 9Router 免费设置 Claude CLI 🚀<br/>by <a href="https://www.youtube.com/@CodeVerseSoban">CodeVerse Soban</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=G-5A_D5Pm6Y">
+        <img src="https://img.youtube.com/vi/G-5A_D5Pm6Y/maxresdefault.jpg" alt="Cài đặt OpenClaw Free A-Z" width="300"/>
+      </a><br/>
+      <b>🇻🇳 Tiếng Việt</b><br/>
+      <sub>从零开始安装 OpenClaw 免费版 + 9Router<br/>by <a href="https://www.youtube.com/@maigia">Mai Gia</a></sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=JXmg8_gccgE">
+        <img src="https://img.youtube.com/vi/JXmg8_gccgE/maxresdefault.jpg" alt="FREE OpenClaw with Claude Opus" width="300"/>
+      </a><br/>
+      <b>🇺🇸 English</b><br/>
+      <sub>免费 OpenClaw + Claude Opus 4.6<br/>by <a href="https://www.youtube.com/@BuildAIWithHamid">Build AI With Hamid</a></sub>
+    </td>
+  </tr>
+</table>
+
+</div>
+
+> 🎬 **制作了关于 9Router 的视频？** 提交 [Pull Request](https://github.com/decolua/9router/pulls)，将你的视频添加到此部分 — 我们会合并它！
+
+---
+
+## 🛠️ 支持的 CLI 工具
+
+9Router 与所有主流 AI 编程工具无缝协作：
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center" width="120">
+        <img src="./public/providers/claude.png" width="60" alt="Claude Code"/><br/>
+        <b>Claude-Code</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/openclaw.png" width="60" alt="OpenClaw"/><br/>
+        <b>OpenClaw</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/codex.png" width="60" alt="Codex"/><br/>
+        <b>Codex</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/opencode.png" width="60" alt="OpenCode"/><br/>
+        <b>OpenCode</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/cursor.png" width="60" alt="Cursor"/><br/>
+        <b>Cursor</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/antigravity.png" width="60" alt="Antigravity"/><br/>
+        <b>Antigravity</b>
+      </td>
+    </tr>
+    <tr>
+      <td align="center" width="120">
+        <img src="./public/providers/cline.png" width="60" alt="Cline"/><br/>
+        <b>Cline</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/continue.png" width="60" alt="Continue"/><br/>
+        <b>Continue</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/droid.png" width="60" alt="Droid"/><br/>
+        <b>Droid</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/roo.png" width="60" alt="Roo"/><br/>
+        <b>Roo</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/copilot.png" width="60" alt="Copilot"/><br/>
+        <b>Copilot</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/kilocode.png" width="60" alt="Kilo Code"/><br/>
+        <b>Kilo Code</b>
+      </td>
+    </tr>
+  </table>
+</div>
+
+---
+
+## 🌐 支持的提供商
+
+### 🔐 OAuth 提供商
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center" width="120">
+        <img src="./public/providers/claude.png" width="60" alt="Claude Code"/><br/>
+        <b>Claude-Code</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/antigravity.png" width="60" alt="Antigravity"/><br/>
+        <b>Antigravity</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/codex.png" width="60" alt="Codex"/><br/>
+        <b>Codex</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/github.png" width="60" alt="GitHub"/><br/>
+        <b>GitHub</b>
+      </td>
+      <td align="center" width="120">
+        <img src="./public/providers/cursor.png" width="60" alt="Cursor"/><br/>
+        <b>Cursor</b>
+      </td>
+    </tr>
+  </table>
+</div>
+
+### 🆓 免费提供商
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center" width="150">
+        <img src="./public/providers/kiro.png" width="70" alt="Kiro"/><br/>
+        <b>Kiro AI</b><br/>
+        <sub>Claude 4.5 + GLM-5 + MiniMax<br/>每月 50 积分免费</sub>
+      </td>
+      <td align="center" width="150">
+        <img src="./public/providers/opencode.png" width="70" alt="OpenCode Free"/><br/>
+        <b>OpenCode Free</b><br/>
+        <sub>无需认证 • 自动获取模型<br/>免费（模型列表会变）</sub>
+      </td>
+      <td align="center" width="150">
+        <img src="./public/providers/gemini.png" width="70" alt="Vertex AI"/><br/>
+        <b>Vertex AI</b><br/>
+        <sub>Gemini 3 Pro + GLM-5 + DeepSeek<br/>$300 免费额度</sub>
+      </td>
+    </tr>
+  </table>
+</div>
+
+> **注意：** iFlow、Qwen Code 和 Gemini CLI 的免费等级已于 2026 年停止。请改用 Kiro / OpenCode Free / Vertex。
+>
+> **Kiro AI** 于 2025 年 9 月转为付费模式 — 免费等级现在上限为**每月 50 积分**（新账户前 30 天另加 500 试用积分）。付费档位：Pro $20/月（1,000 积分）、Pro+ $40/月（2,000）、Pro Max $100/月（5,000）、Power $200/月（10,000）。
+> **OpenCode Free** 的模型列表会随时间变化（部分模型仅限时免费）— 可能随时变更，恕不另行通知。
+> **Vertex AI**：新 GCP 账户的 $300 免费额度仍然有效，但自 2026 年 3 月起 **Gemini API 端点不再消耗这些额度** — 请改用 **Vertex AI Studio** 端点。
+
+### 🔑 API Key 提供商（40+）
+
+<div align="center">
+  <table>
+    <tr>
+      <td align="center" width="100">
+        <img src="./public/providers/openrouter.png" width="50" alt="OpenRouter"/><br/>
+        <sub>OpenRouter</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/glm.png" width="50" alt="GLM"/><br/>
+        <sub>GLM</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/kimi.png" width="50" alt="Kimi"/><br/>
+        <sub>Kimi</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/minimax.png" width="50" alt="MiniMax"/><br/>
+        <sub>MiniMax</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/openai.png" width="50" alt="OpenAI"/><br/>
+        <sub>OpenAI</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/anthropic.png" width="50" alt="Anthropic"/><br/>
+        <sub>Anthropic</sub>
+      </td>
+    </tr>
+    <tr>
+      <td align="center" width="100">
+        <img src="./public/providers/gemini.png" width="50" alt="Gemini"/><br/>
+        <sub>Gemini</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/deepseek.png" width="50" alt="DeepSeek"/><br/>
+        <sub>DeepSeek</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/groq.png" width="50" alt="Groq"/><br/>
+        <sub>Groq</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/xai.png" width="50" alt="xAI"/><br/>
+        <sub>xAI</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/mistral.png" width="50" alt="Mistral"/><br/>
+        <sub>Mistral</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/perplexity.png" width="50" alt="Perplexity"/><br/>
+        <sub>Perplexity</sub>
+      </td>
+    </tr>
+    <tr>
+      <td align="center" width="100">
+        <img src="./public/providers/together.png" width="50" alt="Together"/><br/>
+        <sub>Together AI</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/fireworks.png" width="50" alt="Fireworks"/><br/>
+        <sub>Fireworks</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/cerebras.png" width="50" alt="Cerebras"/><br/>
+        <sub>Cerebras</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/cohere.png" width="50" alt="Cohere"/><br/>
+        <sub>Cohere</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/nvidia.png" width="50" alt="NVIDIA"/><br/>
+        <sub>NVIDIA</sub>
+      </td>
+      <td align="center" width="100">
+        <img src="./public/providers/siliconflow.png" width="50" alt="SiliconFlow"/><br/>
+        <sub>SiliconFlow</sub>
+      </td>
+    </tr>
+  </table>
+  <p><i>...以及 20+ 更多提供商，包括 Nebius、Chutes、Hyperbolic 和自定义 OpenAI/Anthropic 兼容端点</i></p>
+</div>
+
+---
+
+## 💡 主要功能
+
+| 功能 | 作用 | 为什么重要 |
+|---------|--------------|----------------|
+| 🚀 **RTK Token 节省器**（[RTK](https://github.com/rtk-ai/rtk) ⭐40K） | 压缩工具输出（`git diff`、`grep`、`ls`、`tree`...）后再发送给 LLM | 每次请求节省 **20-40% 输入 tokens** |
+| 🪨 **Caveman 模式**（[Caveman](https://github.com/JuliusBrussee/caveman) ⭐52K） | 注入 caveman 风格提示词 → LLM 回复简洁，保留技术实质 | 节省 **高达 65% 输出 tokens** |
+| 🎯 **智能三层切换** | 自动路由：订阅 → 低价 → 免费 | 编程永不停歇，零停机时间 |
+| 📊 **实时配额追踪** | 实时 token 计数 + 重置倒计时 | 充分利用订阅价值 |
+| 🔄 **格式转换** | OpenAI ↔ Claude ↔ Gemini ↔ Cursor ↔ Kiro ↔ Vertex | 兼容任何 CLI 工具 |
+| 👥 **多账户支持** | 每个提供商支持多个账户 | 负载均衡 + 冗余备份 |
+| 🔄 **自动 Token 刷新** | OAuth token 自动刷新 | 无需手动重新登录 |
+| 🎨 **自定义组合** | 创建无限模型组合 | 自定义适合你的切换策略 |
+| 📝 **请求日志** | 调试模式下的完整请求/响应日志 | 轻松排查问题 |
+| 💾 **云同步** | 跨设备同步配置 | 处处相同设置 |
+| 📊 **使用分析** | 追踪 tokens、成本、趋势 | 优化开支 |
+| 🌐 **任意部署** | 本地、VPS、Docker、Cloudflare Workers | 灵活部署选项 |
+
+<details>
+<summary><b>📖 功能详情</b></summary>
+
+### 🚀 RTK Token 节省器
+
+工具输出（`git diff`、`grep`、`find`、`ls`、`tree`、日志转储...）通常占用 30-50% 的提示词预算。RTK 在请求到达 LLM 之前检测并应用智能、无损压缩：
+
+- **过滤器：** `git-diff`、`git-status`、`grep`、`find`、`ls`、`tree`、`dedup-log`、`smart-truncate`、`read-numbered`、`search-list`
+- **自动检测：** 无需配置 — RTK 检查每个 `tool_result` 的前 1KB，选择合适的过滤器。
+- **安全设计：** 如果过滤器失败、抛出异常或使输出变大，RTK 会静默保留原始文本。错误永远不会中断你的请求。
+- **通用兼容：** 适用于所有格式（OpenAI、Claude、Gemini、Cursor、Kiro、OpenAI Responses），因为它在任何格式转换**之前**运行。
+- **默认开启：** 可随时在控制面板 → 端点设置中切换。
+
+```
+不使用 RTK：47K tokens 发送给 LLM
+使用 RTK：    28K tokens 发送给 LLM   (节省 40% · 相同上下文 · 相同答案)
+```
+
+### 🎯 智能三层切换
+
+创建具有自动切换功能的组合：
+
+```
+组合："my-coding-stack"
+  1. cc/claude-opus-4-6        （你的订阅）
+  2. glm/glm-4.7               （低价备份，$0.6/1M）
+  3. if/kimi-k2-thinking       （免费备选）
+
+→ 配额用完或出错时自动切换
+```
+
+### 📊 实时配额追踪
+
+- 每个提供商的 token 消耗
+- 重置倒计时（5小时、每日、每周）
+- 付费等级的成本估算
+- 月度支出报告
+
+### 🔄 格式转换
+
+格式间无缝转换：
+- **OpenAI** ↔ **Claude** ↔ **Gemini** ↔ **Cursor** ↔ **Kiro** ↔ **Vertex** ↔ **Antigravity** ↔ **Ollama** ↔ **OpenAI Responses**
+- 你的 CLI 工具发送 OpenAI 格式 → 9Router 转换 → 提供商接收原生格式
+- 适用于任何支持自定义 OpenAI 端点的工具
+
+### 👥 多账户支持
+
+- 每个提供商添加多个账户
+- 自动轮询或基于优先级的路由
+- 当一个账户达到配额时切换到下一个
+
+### 🔄 自动 Token 刷新
+
+- OAuth token 在过期前自动刷新
+- 无需手动重新认证
+- 所有提供商的无缝体验
+
+### 🎨 自定义组合
+
+- 创建无限模型组合
+- 混合订阅、低价和免费等级
+- 为组合命名以便访问
+- 使用云同步跨设备共享组合
+
+### 📝 请求日志
+
+- 启用调试模式获取完整请求/响应日志
+- 追踪 API 调用、请求头和载荷
+- 排查集成问题
+- 导出日志进行分析
+
+### 💾 云同步
+
+- 跨设备同步提供商、组合和设置
+- 自动后台同步
+- 安全加密存储
+- 从任何地方访问你的设置
+
+#### 云运行时说明
+
+- 生产环境中优先使用服务端云变量：
+  - `BASE_URL`（云同步调度程序使用的内部回调 URL）
+  - `CLOUD_URL`（云同步端点基础 URL）
+- `NEXT_PUBLIC_BASE_URL` 和 `NEXT_PUBLIC_CLOUD_URL` 仍用于兼容性/UI，但服务端运行时现在优先使用 `BASE_URL`/`CLOUD_URL`。
+- 云同步请求现在使用超时 + 快速失败行为，以避免云 DNS/网络不可用时 UI 挂起。
+
+### 📊 使用分���
+
+- 追踪每个提供商和模型的 token 使用量
+- 成本估算和支出趋势
+- 月度报告和洞察
+- 优化你的 AI 支出
+
+> **💡 重要 - 了解控制面板成本：**
+> 
+> 使用分析中显示的"成本"**仅用于追踪和比较目的**。
+> 9Router 本身**永远不会向你收费**。你只直接向提供商付款（如果使用付费服务）。
+> 
+> **示例：** 如果你的控制面板显示使用 Kiro 免费模型时"总成本 $290"，这代表你如果直接使用付费 API 需要支付的金额。你的实际成本 = **$0**（Kiro 免费等级：约 50 积分/月）。
+> 
+> 把它想象成一个"节省追踪器"，展示你通过使用免费模型或通过 9Router 路由节省了多少钱！
+
+### 🌐 任意部署
+
+- 💻 **本地** - 默认，离线可用
+- ☁️ **VPS/云** - 跨设备共享
+- 🐳 **Docker** - 一键部署
+- 🚀 **Cloudflare Workers** - 全球边缘网络
+
+</details>
+
+---
+
+## 💰 价格一览
+
+| 等级 | 提供商 | 成本 | 配额重置 | 适用场景 |
+|------|----------|------|-------------|----------|
+| **🚀 TOKEN 节省器** | **RTK（内置）** | **免费** | 始终开启 | **每次请求节省 20-40% tokens** |
+| **💳 订阅** | Claude Code (Pro/Max) | $20-200/月 | 5小时 + 每周 | 已有订阅的用户 |
+| | Codex (Plus/Pro) | $20-200/月 | 5小时 + 每周 | OpenAI 用户 |
+| | GitHub Copilot | $10-19/月 | 每月 | GitHub 用户 |
+| | Cursor IDE | $20/月 | 每月 | Cursor 用户 |
+| **💰 低价** | GLM-5.1 / GLM-4.7 | $0.6/1M | 每日 10AM | 预算备份 |
+| | MiniMax M2.7 | $0.2/1M | 5小时滚动 | 最便宜选项 |
+| | Kimi K2.5 | $9/月固定 | 10M tokens/月 | 可预测成本 |
+ | **🆓 免费** | Kiro AI | $0 | 50 积分/月 | Claude 4.5 + GLM-5 + MiniMax 免费（之上为付费档位） |
+ | | OpenCode Free | $0 |  varies* | 无需认证，自动获取模型（列表会变化） |
+ | | Vertex AI | $300 额度 | 新 GCP 账户 | Gemini 3 Pro + DeepSeek + GLM-5（使用 Vertex AI Studio 端点消耗免费额度） |
+
+**💡 专业提示：** RTK + Kiro AI + OpenCode Free 组合 = **$0 成本 + 节省 20-40% tokens**！
+
+---
+
+### 📊 理解 9Router 成本与计费
+
+**9Router 计费真相：**
+
+✅ **9Router 软件 = 永久免费**（开源，绝不收费）  
+✅ **控制面板"成本" = 仅用于显示/追踪**（不是实际账单）  
+✅ **你直接向提供商付款**（订阅或 API 费用）  
+✅ **免费提供商保持免费**（Kiro 约 50 积分/月、OpenCode Free、Vertex $300 额度 = 在免费额度内 $0）— 注意 iFlow/Qwen/Gemini CLI 免费等级已于 2026 年停止
+❌ **9Router 永不发送发票** 或扣款
+
+**成本显示如何工作：**
+
+控制面板显示**估算成本**，如同你直接使用付费 API。这**不是计费** — 它是一个比较工具，展示你的节省。
+
+**示例场景：**
+```
+控制面板显示：
+• 总请求数：1,662
+• 总 Tokens：47M
+• 显示成本：$290
+
+实际检查：
+• 提供商：Kiro（免费等级：约 50 积分/月）
+• 实际支付：$0.00
+• $290 意味着什么：通过使用免费模型节省的金额！
+```
+
+**付款规则：**
+- **订阅提供商**（Claude Code、Codex）：通过他们的网站直接付款
+- **低价提供商**（GLM、MiniMax）：直接付款，9Router 只做路由
+- **免费提供商**（Kiro、OpenCode Free、Vertex）：真正的免费，在免费额度内无隐藏费用
+- **9Router**：从不收取任何费用，永远不会
+
+---
+
+## 🎯 使用场景
+
+### 场景 1："我有 Claude Pro 订阅"
+
+**问题：** 配额到期未用完，繁忙编码时遇到速率限制
+
+**解决方案：**
+```
+组合："maximize-claude"
+  1. cc/claude-opus-4-7        （充分利用订阅）
+  2. glm/glm-5.1               （配额用完时的低价备份）
+  3. kr/claude-sonnet-4.5      （免费紧急备选）
+
+月成本：$20（订阅）+ ~$5（备份）= $25 总计
+对比：$20 + 遇到限制 = 沮丧
+```
+
+### 场景 2："我想零成本"
+
+**问题：** 负担不起订阅，需要可靠的 AI 编码
+
+**解决方案：**
+```
+组合："free-forever"
+  1. kr/claude-sonnet-4.5      （通过 Kiro 免费使用 Claude 4.5，约 50 积分/月）
+  2. kr/glm-5                  （通过 Kiro 免费使用 GLM-5）
+  3. oc/<auto>                 （OpenCode Free，无需认证）
+
+月成本：$0
+质量：生产级模型 + RTK 节省 20-40% tokens
+```
+
+### 场景 3："我需要 24/7 编码，不中断"
+
+**问题：** 截止日期紧迫，不能承受停机
+
+**解决方案：**
+```
+组合："always-on"
+  1. cc/claude-opus-4-7        （最佳质量）
+  2. cx/gpt-5.5                （第二个订阅）
+  3. glm/glm-5.1               （低价，每日重置）
+  4. minimax/MiniMax-M2.7      （最便宜，5小时重置）
+  5. kr/claude-sonnet-4.5      （通过 Kiro 免费使用，约 50 积分/月）
+
+结果：5 层切换 = 零停机时间
+月成本：$20-200（订阅）+ $10-20（备份）
+```
+
+### 场景 4："我想在 OpenClaw 中使用免费 AI"
+
+**问题：** 需要在消息应用（WhatsApp、Telegram、Slack...）中使用 AI 助手，完全免费
+
+**解决方案：**
+```
+组合："openclaw-free"
+  1. kr/claude-sonnet-4.5      （Claude 4.5 免费）
+  2. kr/glm-5                  （GLM-5 免费）
+  3. kr/MiniMax-M2.5           （MiniMax 免费）
+
+月成本：$0
+访问方式：WhatsApp、Telegram、Slack、Discord、iMessage、Signal...
+```
+
+---
+
+## ❓ 常见问题
+
+<details>
+<summary><b>📊 为什么我的控制面板显示高成本？</b></summary>
+
+控制面板追踪你的 token 使用情况，并显示**估算成本**，如同你直接使用付费 API。这**不是实际计费** — 它是一个参考，展示你通过使用免费模型或通过 9Router 路由现有订阅节省了多少钱。
+
+**示例：**
+- **控制面板显示：** "$290 总成本"
+- **实际情况：** 你在使用 Kiro 免费模型（约 50 积分/月）
+- **你的实际成本：** **$0.00**
+- **$290 的含义：** 你通过使用免费模型而不是付费 API **节省**的金额！
+
+成本显示是一个"节省追踪器"，帮助你了解使用模式和优化机会。
+
+</details>
+
+<details>
+<summary><b>💳 9Router 会扣我的钱吗？</b></summary>
+
+**不会。** 9Router 是在你自己的电脑上运行的开源软件。它永远不会向你收取任何费用。
+
+**你只需支付：**
+- ✅ **订阅提供商**（Claude Code $20/月、Codex $20-200/月）→ 在他们的网站上直接付款
+- ✅ **低价提供商**（GLM、MiniMax）→ 直接付款，9Router 只是路由你的请求
+- ❌ **9Router 本身** → **永不收费，永远不会**
+
+9Router 是一个本地代理/路由器。它没有你的信用卡，不能发送发票，也没有计费系统。它是完全免费的软件。
+
+</details>
+
+<details>
+<summary><b>🆓 免费提供商真的是无限量的吗？</b></summary>
+
+**基本上是！** 当前的免费提供商（Kiro、OpenCode Free、Vertex）是真正的免费，但免费等级有上限：
+
+这些是各公司提供的免费服务：
+- **Kiro AI**：通过 AWS Builder ID / Google / GitHub OAuth 使用，免费等级约**每月 50 积分**（新账户前 30 天另加 500 试用积分）。之上提供付费档位。
+- **OpenCode Free**：无认证直连代理，模型从 `opencode.ai/zen/v1/models` 自动获取。免费模型列表会随时间变化（部分模型仅限时免费）— 可能随时变更。
+- **Vertex AI**：新 Google Cloud 账户可获得 $300 免费额度（90 天）。自 2026 年 3 月起 Gemini API 端点不再消耗这些额度 — 请改用 **Vertex AI Studio** 端点。
+
+9Router 只是路由你的请求到它们 — 没有"陷阱"或未来的计费。它们是真正的免费服务，9Router 让它们易于使用并支持切换。
+
+**已停止的免费等级（不再推荐）：**
+- ❌ **iFlow**：曾是免费无限量，现在改为付费（2026）
+- ❌ **Qwen Code**：阿里巴巴于 2026-04-15 完全停止免费 OAuth 等级
+- ❌ **Gemini CLI**：Google 已于 2026-06-18 完全停止服务（由闭源的 Antigravity CLI 取代）。已停止 — 请勿使用。
+
+</details>
+
+<details>
+<summary><b>💰 如何最小化我的实际 AI 成本？</b></summary>
+
+**免费优先策略：**
+
+1. **从 100% 免费组合开始：**
+   ```
+   1. kr/glm-5 (通过 Kiro 免费使用 GLM-5，约 50 积分/月)
+   2. OpenCode Free 模型（无认证，自动获取）
+   3. Vertex AI Gemini 3 Pro（使用 Vertex AI Studio 端点 + $300 额度）
+   ```
+   **成本：$0/月**（在 Kiro 免费积分上限内；OpenCode/Vertex 受各自免费等级限制）
+
+2. **仅在需要时添加低价备份：**
+   ```
+   4. glm/glm-4.7 ($0.6/1M tokens)
+   ```
+   **额外成本：只为实际使用的部分付费**
+
+3. **最后使用订阅提供商：**
+   - 仅当你已有订阅时
+   - 9Router 通过配额追踪帮助最大化其价值
+
+**结果：** 大多数用户可以仅使用免费等级以 $0/月运行！
+
+</details>
+
+<details>
+<summary><b>📈 如果我的使用量突然激增怎么办？</b></summary>
+
+9Router 的智能切换可以防止意外费用：
+
+**场景：** 你正在进行编码冲刺，用尽了配额
+
+**没有 9Router：**
+- ❌ 达到速率限制 → 工作停止 → 沮丧
+- ❌ 或者：不慎累积大量 API 账单
+
+**有 9Router：**
+- ✅ 订阅达到限制 → 自动切换到低价等级
+- ✅ 低价等级变得昂贵 → 自动切换到免费等级
+- ✅ 编程永不停歇 → 可预测的成本
+
+**你掌控一切：** 在控制面板中设置每个提供商的支出限制，9Router 会遵守它们。
+
+</details>
+
+---
+
+## 📖 设置指南
+
+<details>
+<summary><b>🔐 订阅提供商（充分利用价值）</b></summary>
+
+### Claude Code (Pro/Max)
+
+```bash
+控制面板 → 提供商 → 连接 Claude Code
+→ OAuth 登录 → 自动 token 刷新
+→ 5小时 + 每周配额追踪
+
+模型：
+  cc/claude-opus-4-7
+  cc/claude-opus-4-6
+  cc/claude-sonnet-4-6
+  cc/claude-haiku-4-5-20251001
+```
+
+**专业提示：** 复杂任务使用 Opus，追求速度使用 Sonnet。9Router 按模型追踪配额！
+
+### OpenAI Codex (Plus/Pro)
+
+```bash
+控制面板 → 提供商 → 连接 Codex
+→ OAuth 登录（端口 1455）
+→ 5小时 + 每周重置
+
+模型：
+  cx/gpt-5.5
+  cx/gpt-5.4
+  cx/gpt-5.3-codex
+  cx/gpt-5.2-codex
+```
+
+### GitHub Copilot
+
+```bash
+控制面板 → 提供商 → 连接 GitHub
+→ 通过 GitHub 进行 OAuth
+→ 每月重置（每月 1 日）
+
+模型：
+  gh/gpt-5.4
+  gh/claude-opus-4.7
+  gh/claude-sonnet-4.6
+  gh/gemini-3.1-pro-preview
+  gh/grok-code-fast-1
+```
+
+### Cursor IDE
+
+```bash
+控制面板 → 提供商 → 连接 Cursor
+→ OAuth 登录
+→ 每月订阅
+
+模型：
+  cu/claude-4.6-opus-max
+  cu/claude-4.5-sonnet-thinking
+  cu/gpt-5.3-codex
+```
+
+</details>
+
+<details>
+<summary><b>💰 低价提供商（备份）</b></summary>
+
+### GLM-5.1 / GLM-4.7（每日重置，$0.6/1M）
+
+1. 注册：[Zhipu AI](https://open.bigmodel.cn/)
+2. 从编程计划获取 API key
+3. 控制面板 → 添加 API Key：
+   - 提供商：`glm`
+   - API Key：`your-key`
+
+**使用：** `glm/glm-5.1`、`glm/glm-5`、`glm/glm-4.7`
+
+**专业提示：** 编程计划提供 3 倍配额，成本仅为 1/7！每日 10:00 AM 重置。
+
+### MiniMax M2.7（5小时重置，$0.20/1M）
+
+1. 注册：[MiniMax](https://www.minimax.io/)
+2. 获取 API key
+3. 控制面板 → 添加 API Key
+
+**使用：** `minimax/MiniMax-M2.7`、`minimax/MiniMax-M2.5`
+
+**专业提示：** 长上下文（1M tokens）的最便宜选项！
+
+### Kimi K2.5（$9/月固定）
+
+1. 订阅：[Moonshot AI](https://platform.moonshot.ai/)
+2. 获取 API key
+3. 控制面板 → 添加 API Key
+
+**使用：** `kimi/kimi-k2.5`、`kimi/kimi-k2.5-thinking`
+
+**专业提示：** 每月 $9 固定费用获得 10M tokens = 实际成本 $0.90/1M！
+
+</details>
+
+<details>
+<summary><b>🆓 免费提供商（推荐）</b></summary>
+
+### Kiro AI（Claude 4.5 + GLM-5 + MiniMax 免费）
+
+```bash
+控制面板 → 连接 Kiro
+→ AWS Builder ID、AWS IAM Identity Center、Google 或 GitHub
+→ 无限量使用
+
+模型：
+  kr/claude-sonnet-4.5
+  kr/claude-haiku-4.5
+  kr/glm-5
+  kr/MiniMax-M2.5
+  kr/qwen3-coder-next
+  kr/deepseek-3.2
+```
+
+**专业提示：** Claude 最佳免费选项。无需 API key，无需付款，完全无限量。
+
+### OpenCode Free（无需认证，自动获取模型）
+
+```bash
+控制面板 → 连接 OpenCode Free
+→ 无需登录（直连代理）
+→ 模型从 opencode.ai/zen/v1/models 自动获取
+```
+
+**专业提示：** 最快的设置。连接后即可开始编码。
+
+### Vertex AI（新 GCP 账户 $300 免费额度）
+
+```bash
+控制面板 → 连接 Vertex AI
+→ 上传 Google Cloud 服务账户 JSON
+→ 在你的 GCP 项目中启用 Vertex AI API
+
+模型：
+  vertex/gemini-3.1-pro-preview
+  vertex/gemini-3-flash-preview
+  vertex/gemini-2.5-flash
+
+Vertex 合作伙伴（通过 Vertex 提供 Anthropic / DeepSeek / GLM / Qwen）：
+  vertex-partner/glm-5-maas
+  vertex-partner/deepseek-v3.2-maas
+  vertex-partner/qwen3-next-80b-a3b-thinking-maas
+```
+
+**专业提示：** 新 Google Cloud 账户可获得 90 天内 $300 免费额度。足够日常编码使用。
+
+</details>
+
+<details>
+<summary><b>🎨 创建组合</b></summary>
+
+### 示例 1：充分利用订阅 → 低价备份
+
+```
+控制面板 → 组合 → 创建新组合
+
+名称：premium-coding
+模型：
+  1. cc/claude-opus-4-7 (订阅主用)
+  2. glm/glm-5.1 (低价备份，$0.6/1M)
+  3. minimax/MiniMax-M2.7 (最便宜的备选，$0.20/1M)
+
+在 CLI 中使用：premium-coding
+
+月度成本示例（100M tokens）：
+  80M 通过 Claude（订阅）：$0 额外费用
+  15M 通过 GLM：$9
+  5M 通过 MiniMax：$1
+  总计：$10 + 你的订阅费用
+```
+
+### 示例 2：仅免费（零成本）
+
+```
+名称：free-combo
+模型：
+  1. kr/claude-sonnet-4.5 (通过 Kiro 免费使用 Claude 4.5，约 50 积分/月)
+  2. kr/glm-5 (通过 Kiro 免费使用 GLM-5)
+  3. vertex/gemini-3.1-pro-preview ($300 免费额度)
+
+成本：通过 RTK 永久 $0（+ 节省 20-40% tokens）！
+```
+
+</details>
+
+<details>
+<summary><b>🔧 CLI 集成</b></summary>
+
+### Cursor IDE
+
+```
+设置 → 模型 → 高级：
+  OpenAI API Base URL：http://localhost:20128/v1
+  OpenAI API Key：[来自 9router 控制面板]
+  Model：cc/claude-opus-4-7
+```
+
+或使用组合：`premium-coding`
+
+### Claude Code
+
+编辑 `~/.claude/config.json`：
+
+```json
+{
+  "anthropic_api_base": "http://localhost:20128/v1",
+  "anthropic_api_key": "your-9router-api-key"
+}
+```
+
+### Codex CLI
+
+```bash
+export OPENAI_BASE_URL="http://localhost:20128"
+export OPENAI_API_KEY="your-9router-api-key"
+
+codex "your prompt"
+```
+
+### OpenClaw
+
+**选项 1 — 控制面板（推荐）：**
+
+```
+控制面板 → CLI 工具 → OpenClaw → 选择模型 → 应用
+```
+
+**选项 2 — 手动：** 编辑 `~/.openclaw/openclaw.json`：
+
+```json
+{
+  "agents": {
+    "defaults": {
+      "model": {
+        "primary": "9router/kr/claude-sonnet-4.5"
+      }
+    }
+  },
+  "models": {
+    "providers": {
+      "9router": {
+        "baseUrl": "http://127.0.0.1:20128/v1",
+        "apiKey": "sk_9router",
+        "api": "openai-completions",
+        "models": [
+          {
+            "id": "kr/claude-sonnet-4.5",
+            "name": "Claude Sonnet 4.5 (Kiro Free)"
+          }
+        ]
+      }
+    }
+  }
+}
+```
+
+> **注意：** OpenClaw 仅适用于本地 9Router。使用 `127.0.0.1` 而不是 `localhost` 以避免 IPv6 解析问题。
+
+### Cline / Continue / RooCode
+
+```
+Provider：OpenAI 兼容
+Base URL：http://localhost:20128/v1
+API Key：[来自控制面板]
+Model：cc/claude-opus-4-7
+```
+
+</details>
+
+<details>
+<summary><b>🚀 部署</b></summary>
+
+### VPS 部署
+
+```bash
+# 克隆并安装
+git clone https://github.com/decolua/9router.git
+cd 9router
+npm install
+npm run build
+
+# 配置
+export JWT_SECRET="your-secure-secret-change-this"
+export INITIAL_PASSWORD="your-password"
+export DATA_DIR="/var/lib/9router"
+export PORT="20128"
+export HOSTNAME="0.0.0.0"
+export NODE_ENV="production"
+export NEXT_PUBLIC_BASE_URL="http://localhost:20128"
+export NEXT_PUBLIC_CLOUD_URL="https://9router.com"
+export API_KEY_SECRET="endpoint-proxy-api-key-secret"
+export MACHINE_ID_SALT="endpoint-proxy-salt"
+
+# 启动
+npm run start
+
+# 或使用 PM2
+npm install -g pm2
+pm2 start npm --name 9router -- start
+pm2 save
+pm2 startup
+```
+
+### Docker
+
+```bash
+# 构建镜像（从仓库根目录）
+docker build -t 9router .
+
+# 运行容器（当前设置使用的命令）
+docker run -d \
+  --name 9router \
+  -p 20128:20128 \
+  --env-file /root/dev/9router/.env \
+  -v 9router-data:/app/data \
+  -v 9router-usage:/root/.9router \
+  9router
+```
+
+便携命令（如果你已经在仓库根目录）：
+
+```bash
+docker run -d \
+  --name 9router \
+  -p 20128:20128 \
+  --env-file ./.env \
+  -v 9router-data:/app/data \
+  -v 9router-usage:/root/.9router \
+  9router
+```
+
+容器默认值：
+- `PORT=20128`
+- `HOSTNAME=0.0.0.0`
+
+常用命令：
+
+```bash
+docker logs -f 9router
+docker restart 9router
+docker stop 9router && docker rm 9router
+```
+
+### 环境变量
+
+| 变量 | 默认值 | 描述 |
+|----------|---------|-------------|
+| `JWT_SECRET` | 自动生成（`~/.9router/jwt-secret`） | 用于控制面板 auth cookie 的 JWT 签名密钥（设置可在多实例间共享） |
+| `INITIAL_PASSWORD` | `123456` | 当没有保存的哈希时首次登录的密码 |
+| `DATA_DIR` | `~/.9router` | 主应用数据库位置（`db.json`） |
+| `PORT` | 框架默认值 | 服务端口（示例中为 `20128`） |
+| `HOSTNAME` | 框架默认值 | 绑定主机（Docker 默认为 `0.0.0.0`） |
+| `NODE_ENV` | 运行时默认值 | 设置 `production` 用于部署 |
+| `BASE_URL` | `http://localhost:20128` | 云同步任务使用的服务端内部基础 URL |
+| `CLOUD_URL` | `https://9router.com` | 服务端云同步端点基础 URL |
+| `NEXT_PUBLIC_BASE_URL` | `http://localhost:3000` | 向后兼容/公开基础 URL（服务端运行时优先使用 `BASE_URL`） |
+| `NEXT_PUBLIC_CLOUD_URL` | `https://9router.com` | 向后兼容/公开云 URL（服务端运行时优先使用 `CLOUD_URL`） |
+| `API_KEY_SECRET` | `endpoint-proxy-api-key-secret` | 生成 API key 的 HMAC 密钥 |
+| `MACHINE_ID_SALT` | `endpoint-proxy-salt` | 稳定机器 ID 哈希的盐值 |
+| `ENABLE_REQUEST_LOGS` | `false` | 在 `logs/` 下启用请求/响应日志 |
+| `AUTH_COOKIE_SECURE` | `false` | 强制 `Secure` auth cookie（在 HTTPS 反向代理后面设置为 `true`） |
+| `REQUIRE_API_KEY` | `false` | 在 `/v1/*` 路由上强制使用 Bearer API key（面向互联网部署时推荐） |
+| `HTTP_PROXY`、`HTTPS_PROXY`、`ALL_PROXY`、`NO_PROXY` | 空 | 用于上游提供商调用的可选出站代理 |
+
+注意：
+- 也支持小写代理变量：`http_proxy`、`https_proxy`、`all_proxy`、`no_proxy`。
+- `.env` 不会打包到 Docker 镜像中（`.dockerignore`）；使用 `--env-file` 或 `-e` 注入运行时配置。
+- 在 Windows 上，`APPDATA` 可用于本地存储路径解析。
+- `INSTANCE_NAME` 出现在较旧的文档/环境变量模板中，但当前运行时未使用。
+
+### 运行时文件和存储
+
+- 主应用状态：`${DATA_DIR}/db.json`（提供商、组合、别名、密钥、设置），由 `src/lib/localDb.js` 管理。
+- 使用历史和日志：`${DATA_DIR}/usage.json` 和 `${DATA_DIR}/log.txt`，由 `src/lib/usageDb.js` 管理。
+- 可选的请求/翻译器日志：`ENABLE_REQUEST_LOGS=true` 时位于 `<repo>/logs/...`。
+- `${DATA_DIR}` 和 `~/.9router` 在 Docker 容器中解析到同一位置 — 符号链接 `/root/.9router -> /app/data` 在构建时创建。
+
+</details>
+
+---
+
+## 📊 可用模型
+
+<details>
+<summary><b>查看所有可用模型</b></summary>
+
+**Claude Code（`cc/`）** - Pro/Max：
+- `cc/claude-opus-4-7`
+- `cc/claude-opus-4-6`
+- `cc/claude-sonnet-4-6`
+- `cc/claude-sonnet-4-5-20250929`
+- `cc/claude-haiku-4-5-20251001`
+
+**Codex（`cx/`）** - Plus/Pro：
+- `cx/gpt-5.5`
+- `cx/gpt-5.4`
+- `cx/gpt-5.3-codex`
+- `cx/gpt-5.2-codex`
+- `cx/gpt-5.1-codex-max`
+
+**GitHub Copilot（`gh/`）**：
+- `gh/gpt-5.4`
+- `gh/claude-opus-4.7`
+- `gh/claude-sonnet-4.6`
+- `gh/gemini-3.1-pro-preview`
+- `gh/grok-code-fast-1`
+
+**Cursor（`cu/`）** - 订阅：
+- `cu/claude-4.6-opus-max`
+- `cu/claude-4.5-sonnet-thinking`
+- `cu/gpt-5.3-codex`
+- `cu/kimi-k2.5`
+
+**GLM（`glm/`）** - $0.6/1M：
+- `glm/glm-5.1`
+- `glm/glm-5`
+- `glm/glm-4.7`
+
+**MiniMax（`minimax/`）** - $0.2/1M：
+- `minimax/MiniMax-M2.7`
+- `minimax/MiniMax-M2.5`
+
+**Kimi（`kimi/`）** - $9/月固定：
+- `kimi/kimi-k2.5`
+- `kimi/kimi-k2.5-thinking`
+
+**Kiro（`kr/`）** - 免费（约 50 积分/月，之上为付费档位）：
+- `kr/claude-sonnet-4.5`
+- `kr/claude-haiku-4.5`
+- `kr/glm-5`
+- `kr/MiniMax-M2.5`
+- `kr/qwen3-coder-next`
+- `kr/deepseek-3.2`
+
+**OpenCode Free（`oc/`）** - 免费无需认证：
+- 从 `opencode.ai/zen/v1/models` 自动获取
+
+**Vertex AI（`vertex/`）** - $300 免费额度：
+- `vertex/gemini-3.1-pro-preview`
+- `vertex/gemini-3-flash-preview`
+- `vertex/gemini-2.5-flash`
+- `vertex-partner/glm-5-maas`
+- `vertex-partner/deepseek-v3.2-maas`
+
+</details>
+
+---
+
+## 🐛 故障排除
+
+**"语言模型未提供消息"**
+- 提供商配额耗尽 → 检查控制面板配额追踪器
+- 解决方案：使用组合切换或切换到更便宜的等级
+
+**速率限制**
+- 订阅配额用完 → 切换到 GLM/MiniMax
+- 添加组合：`cc/claude-opus-4-7 → glm/glm-5.1 → kr/claude-sonnet-4.5`
+
+**OAuth token 已过期**
+- 9Router 自动刷新
+- 如果问题持续：控制面板 → 提供商 → 重新连接
+
+**高成本**
+- 在控制面板 → 端点设置中启用 RTK（默认开启，节省 20-40% tokens）
+- 在控制面板中检查使用统计
+- 将主模型切换到 GLM/MiniMax
+- 对于非关键任务使用免费等级（Kiro、OpenCode Free、Vertex）
+
+**控制面板在错误端口打开**
+- 设置 `PORT=20128` 和 `NEXT_PUBLIC_BASE_URL=http://localhost:20128`
+
+**首次登录不工作**
+- 检查 `.env` 中的 `INITIAL_PASSWORD`
+- 如果未设置，回退密码是 `123456`
+
+**`logs/` 下没有请求日志**
+- 设置 `ENABLE_REQUEST_LOGS=true`
+
+---
+
+## 🛠️ 技术栈
+
+- **运行时**：Node.js 20+
+- **框架**：Next.js 16
+- **UI**：React 19 + Tailwind CSS 4
+- **数据库**：LowDB（基于 JSON 文件）
+- **流式传输**：Server-Sent Events (SSE)
+- **认证**：OAuth 2.0 (PKCE) + JWT + API Keys
+
+---
+
+## 📝 API 参考
+
+### 聊天补全
+
+```bash
+POST http://localhost:20128/v1/chat/completions
+Authorization: Bearer your-api-key
+Content-Type: application/json
+
+{
+  "model": "cc/claude-opus-4-6",
+  "messages": [
+    {"role": "user", "content": "Write a function to..."}
+  ],
+  "stream": true
+}
+```
+
+### 列出模型
+
+```bash
+GET http://localhost:20128/v1/models
+Authorization: Bearer your-api-key
+
+→ 以 OpenAI 格式返回所有模型和组合
+```
+
+## 📧 支持
+
+- **网站**：[9router.com](https://9router.com)
+- **GitHub**：[github.com/decolua/9router](https://github.com/decolua/9router)
+- **问题**：[github.com/decolua/9router/issues](https://github.com/decolua/9router/issues)
+
+---
+
+## 👥 贡献者
+
+感谢所有帮助改进 9Router 的贡献者！
+
+[![Contributors](https://contrib.rocks/image?repo=decolua/9router&max=150&columns=15&anon=1&v=20260309)](https://github.com/decolua/9router/graphs/contributors)
+
+---
+
+## 📊 Star 图表
+
+[![Star Chart](https://starchart.cc/decolua/9router.svg?variant=adaptive)](https://starchart.cc/decolua/9router)
+
+
+
+## 🔀 分支
+
+**[OmniRoute](https://github.com/diegosouzapw/OmniRoute)** — 9Router 的全功能 TypeScript 分支。增加了 36+ 提供商、4 层自动切换、多模态 API（图像、嵌入、音频、TTS）、断路器、语义缓存、LLM 评估和精美的控制面板。368+ 单元测试。可通过 npm 和 Docker 使用。
+
+---
+
+## 🙏 致谢
+
+站在巨人的肩膀上构建：
+
+- **CLIProxyAPI** — 启发了这个 JavaScript 移植的原始 Go 实现。
+- **[RTK](https://github.com/rtk-ai/rtk)** ![Stars](https://img.shields.io/github/stars/rtk-ai/rtk?style=flat&color=yellow) — Rust token 节省器。9Router 将其压缩管道移植到 JS → 每次请求 **减少 20-40% 输入 tokens**。
+- **[Caveman](https://github.com/JuliusBrussee/caveman)** ![Stars](https://img.shields.io/github/stars/JuliusBrussee/caveman?style=flat&color=yellow) by **[@JuliusBrussee](https://github.com/JuliusBrussee)** — 病毒式传播的 *"为什么用很多 token 当少的 token 就能搞定"*。9Router 适配其提示词 → **减少 65% 输出 tokens**。
+
+非常感谢这些作者 — 没有他们的工作，9Router 的 token 节省功能就不会存在。在 GitHub 上给他们加星！
+
+---
+
+## 📄 许可证
+
+MIT 许可证 — 详见 [LICENSE](LICENSE)。
+
+---
+
+<div align="center">
+  <sub>用 ❤️ 为 24/7 编程的开发者构建</sub>
+</div>

README_HUGGINGFACE.md

@@ -0,0 +1,25 @@
+# Run 9Router on Hugging Face Spaces
+
+## What this fork adds
+
+- `hf-server.js` — launch wrapper that respects Hugging Face Spaces' default `PORT=7860` and `HOSTNAME=0.0.0.0`.
+- `package.json` adds `build:hf` / `start:hf` scripts.
+- `Dockerfile` now defaults to `PORT=7860` and includes the SQLite WASM dependency needed for serverless persistence.
+
+## Deploy
+
+1. Create a new Hugging Face Space.
+2. Set the Space SDK to **Docker**.
+3. Push this repo to the Space.
+4. In Space Settings → Variables, set at least:
+   - `JWT_SECRET`
+   - `INITIAL_PASSWORD`
+   - `API_KEY_SECRET`
+   - `MACHINE_ID_SALT`
+5. The build will run `npm install` + `npm run build` automatically. On success, HF serves the app on the Space URL at port 7860.
+
+## Notes
+
+- Data persists in the container filesystem for the life of the Space. For long-term persistence, attach an HF dataset or volume if your Space plan supports it, or sync via the built-in cloud sync if you run 9router.com.
+- Headroom is not bundled by default. If you need token saving, run Headroom externally and set `HEADROOM_URL`.
+- Default admin password is `123456`. Override `INITIAL_PASSWORD` immediately.

captain-definition

@@ -0,0 +1,4 @@
+{
+  "schemaVersion": 2,
+  "dockerfilePath": "./Dockerfile"
+}

custom-server.js

@@ -0,0 +1,139 @@
+const http = require("http");
+const path = require("path");
+const fs = require("fs");
+const crypto = require("crypto");
+const { pathToFileURL } = require("url");
+
+const origCreate = http.createServer.bind(http);
+
+// Per-process secret proving x-9r-real-ip was stamped below rather than sent by the client.
+// A bare `next start` / `next dev` never loads this file, so it cannot produce a matching
+// header even though the env var is inherited by child processes. Named like x-9r-cli-token
+// so the request-detail header sanitizer redacts it too.
+const PEER_TOKEN = crypto.randomBytes(24).toString("hex");
+process.env.NINEROUTER_PEER_TOKEN = PEER_TOKEN;
+
+let backgroundRefreshStarted = false;
+
+function startBackgroundTokenRefreshFromCustomServer() {
+  if (backgroundRefreshStarted) return;
+  backgroundRefreshStarted = true;
+  // Prefer source path (repo / standalone that still has src). Fail-open if missing
+  // — initializeApp also starts the same scheduler when the Next app boots.
+  const modPath = path.join(__dirname, "src", "sse", "services", "backgroundTokenRefresh.js");
+  import(pathToFileURL(modPath).href)
+    .then((m) => {
+      try {
+        m.startBackgroundTokenRefresh();
+      } catch (e) {
+        console.error("[BackgroundTokenRefresh] start failed:", e && e.message ? e.message : e);
+      }
+      const stop = () => {
+        try {
+          m.stopBackgroundTokenRefresh();
+        } catch {
+          /* ignore */
+        }
+      };
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+    })
+    .catch((e) => {
+      // Expected in published CLI standalone (src/ not on disk). App bootstrap covers it.
+      if (process.env.DEBUG_BACKGROUND_TOKEN_REFRESH) {
+        console.error("[BackgroundTokenRefresh] import failed:", e && e.message ? e.message : e);
+      }
+    });
+}
+
+// Wrap Next standalone HTTP server: derive client IP from the TCP socket
+// (unspoofable) and strip client-supplied forwarding headers so downstream
+// rate-limiting keys on the real peer address instead of attacker-controlled XFF.
+http.createServer = (...args) => {
+  const handler = args.find((a) => typeof a === "function");
+  const rest = args.filter((a) => typeof a !== "function");
+  if (!handler) return origCreate(...args);
+  const wrapped = (req, res) => {
+    const socketIp = req.socket && req.socket.remoteAddress ? req.socket.remoteAddress : "";
+    const xff = req.headers["x-forwarded-for"];
+    const xRealIp = req.headers["x-real-ip"];
+    const viaProxy = !!(xff || xRealIp);
+    const isLoopbackProxy = socketIp === "127.0.0.1" || socketIp === "::1" || socketIp === "::ffff:127.0.0.1";
+    // Trust forwarding headers only when the TCP peer is a local reverse proxy.
+    // Direct/public sockets remain keyed by the unspoofable peer address.
+    const proxyIp = xRealIp || (xff ? String(xff).split(",")[0].trim() : "");
+    const ip = isLoopbackProxy && proxyIp ? proxyIp : socketIp;
+    delete req.headers["x-9r-real-ip"];
+    delete req.headers["x-forwarded-for"];
+    delete req.headers["x-9r-via-proxy"];
+    delete req.headers["x-9r-peer-token"];
+    req.headers["x-9r-real-ip"] = ip;
+    req.headers["x-9r-peer-token"] = PEER_TOKEN;
+    if (viaProxy) req.headers["x-9r-via-proxy"] = "1";
+    return handler(req, res);
+  };
+  const server = origCreate(...rest, wrapped);
+  server.once("listening", () => {
+    startBackgroundTokenRefreshFromCustomServer();
+  });
+  const origEmit = server.emit;
+  // JBR 25 sends h2c upgrades that the HTTP/1.1 server would otherwise close.
+  server.emit = function (event, ...eventArgs) {
+    const [req, socket, head] = eventArgs;
+    if (event !== "upgrade" || String(req.headers.upgrade || "").toLowerCase() !== "h2c") {
+      return origEmit.call(this, event, ...eventArgs);
+    }
+
+    const contentLength = Number(req.headers["content-length"] || 0);
+    if (!Number.isSafeInteger(contentLength) || contentLength < 0) {
+      socket.destroy();
+      return true;
+    }
+    const chunks = [head];
+    let received = head.length;
+    const serve = () => {
+      // Replay the upgraded request through the existing HTTP/1.1 handler.
+      const replay = new http.IncomingMessage(socket);
+      Object.assign(replay, { method: req.method, url: req.url, headers: req.headers, complete: true });
+      if (received) replay.push(Buffer.concat(chunks, received).subarray(0, contentLength));
+      replay.push(null);
+      const res = new http.ServerResponse(replay);
+      res.shouldKeepAlive = false;
+      res.assignSocket(socket);
+      res.once("finish", () => socket.end());
+      Promise.resolve().then(() => wrapped(replay, res)).catch((error) => {
+        console.error("Failed to downgrade h2c request", error);
+        socket.destroy();
+      });
+    };
+    if (received >= contentLength) serve();
+    else {
+      socket.on("data", function readBody(chunk) {
+        chunks.push(chunk);
+        received += chunk.length;
+        if (received < contentLength) return;
+        socket.off("data", readBody);
+        serve();
+      });
+      socket.resume();
+    }
+    delete req.headers.upgrade;
+    delete req.headers["http2-settings"];
+    req.headers.connection = "close";
+    return true;
+  };
+  return server;
+};
+
+if (require.main === module) {
+  const standalone = path.join(__dirname, "server.js");
+  if (fs.existsSync(standalone)) {
+    require(standalone);
+  } else {
+    // Repo checkout has no standalone build next to us. `next start` builds its HTTP
+    // server in-process, so the wrapper above still sanitizes every request.
+    const nextBin = require.resolve("next/dist/bin/next");
+    process.argv = [process.argv[0], nextBin, "start", ...process.argv.slice(2)];
+    require(nextBin);
+  }
+}

docker-compose.yml

@@ -1,178 +1,30 @@
-# ──────────────────────────────────────────────────────────────────────
-#  OmniRoute — Docker Compose
-# ──────────────────────────────────────────────────────────────────────
-#
-#  Profiles:
-#    base  → minimal image, no CLI tools
-#    web   → runner-web (+Chromium/Playwright) for web-cookie providers
-#    cli   → CLIs installed inside the container (portable)
-#    host  → runner-base + host-mounted CLI binaries (Linux-first)
-#    cliproxyapi → CLIProxyAPI sidecar on port 8317
-#
-#  Usage:
-#    docker compose --profile base up -d
-#    docker compose --profile web up -d   # gemini-web / claude-web / claude-turnstile
-#    docker compose --profile cli up -d
-#    docker compose --profile host up -d
-#    docker compose --profile cliproxyapi up -d
-#    docker compose --profile cli --profile cliproxyapi up -d
-#
-#  Before first run, copy .env.example → .env and edit your secrets.
-# ──────────────────────────────────────────────────────────────────────
-
-x-common: &common
-  restart: unless-stopped
-  stop_grace_period: 40s
-  env_file: .env
-  environment:
-    - DATA_DIR=/app/data # Must match the volume mount below
-    - PORT=${PORT:-20128}
-    - DASHBOARD_PORT=${DASHBOARD_PORT:-20128}
-    - API_PORT=${API_PORT:-20129}
-    - API_HOST=${API_HOST:-0.0.0.0}
-    - REDIS_URL=${REDIS_URL:-redis://redis:6379}
-  volumes:
-    - ./data:/app/data
-  healthcheck:
-    test: ["CMD", "node", "healthcheck.mjs"]
-    interval: 30s
-    timeout: 5s
-    retries: 3
-    start_period: 15s
-
 services:
-  # ── Redis (Rate Limiter Backend) ──────────────────────────────────
-  redis:
-    image: docker.io/library/redis:7-alpine
-    container_name: omniroute-redis
-    restart: unless-stopped
+  9router:
+    image: decolua/9router:latest
+    container_name: 9router
+    restart: always
     ports:
-      - "${REDIS_PORT:-6379}:6379"
+      - "20128:20128"
     volumes:
-      - redis-data:/data
-    command: redis-server --save 60 1 --loglevel warning
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-
-  # ── Profile: base (minimal, no CLI tools) ──────────────────────────
-  omniroute-base:
-    <<: *common
-    container_name: omniroute
-    build:
-      context: .
-      target: runner-base
-    image: omniroute:base
-    ports:
-      - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
-      - "${API_PORT:-20129}:${API_PORT:-20129}"
-    profiles:
-      - base
-
-  # ── Profile: web (runner-web + Chromium/Playwright) ────────────────
-  # Required for web-cookie providers (gemini-web, claude-web, claude-turnstile).
-  # The default `base` image ships without Chromium, so those providers fail
-  # with "Executable doesn't exist at .../ms-playwright/chromium..." (#2832).
-  omniroute-web:
-    <<: *common
-    container_name: omniroute
-    build:
-      context: .
-      target: runner-web
-    image: omniroute:web
-    ports:
-      - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
-      - "${API_PORT:-20129}:${API_PORT:-20129}"
-    profiles:
-      - web
-
-  # ── Profile: cli (CLIs installed inside container) ─────────────────
-  omniroute-cli:
-    <<: *common
-    container_name: omniroute
-    build:
-      context: .
-      target: runner-cli
-    image: omniroute:cli
-    ports:
-      - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
-      - "${API_PORT:-20129}:${API_PORT:-20129}"
-    volumes:
-      - ./data:/app/data
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /usr/libexec/docker/cli-plugins:/usr/libexec/docker/cli-plugins:ro
-      - ${AUTO_UPDATE_HOST_REPO_DIR:-.}:/workspace/omniroute:rw
-    profiles:
-      - cli
-
-  # ── Profile: host (host-mounted CLI binaries, Linux-first) ────────
-  omniroute-host:
-    <<: *common
-    container_name: omniroute
-    build:
-      context: .
-      target: runner-base
-    image: omniroute:base
-    ports:
-      - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
-      - "${API_PORT:-20129}:${API_PORT:-20129}"
+      - 9router-data:/app/data
+    env_file:
+      - .env
     environment:
-      - DATA_DIR=/app/data
-      - PORT=${PORT:-20128}
-      - DASHBOARD_PORT=${DASHBOARD_PORT:-20128}
-      - API_PORT=${API_PORT:-20129}
-      - API_HOST=${API_HOST:-0.0.0.0}
-      - CLI_MODE=host
-      - CLI_EXTRA_PATHS=/host-local/bin:/host-node/bin
-      - CLI_CONFIG_HOME=/host-home
-      - CLI_ALLOW_CONFIG_WRITES=true
-      # Uncomment per-tool overrides as needed:
-      # - CLI_CURSOR_BIN=agent
-      # - CLI_CLINE_BIN=cline
-      # - CLI_CONTINUE_BIN=cn
-    volumes:
-      - ./data:/app/data
-      # ── Host binary mounts (read-only) ──
-      # Adjust paths below to match YOUR host system.
-      - ~/.local/bin:/host-local/bin:ro
-      # Node global binaries (adjust node version path)
-      # - ~/.nvm/versions/node/v24.14.1/bin:/host-node/bin:ro
-      # ── Host config mounts (read-write) ──
-      - ~/.codex:/host-home/.codex:rw
-      - ~/.claude:/host-home/.claude:rw
-      - ~/.factory:/host-home/.factory:rw
-      - ~/.openclaw:/host-home/.openclaw:rw
-      - ~/.cursor:/host-home/.cursor:rw
-      - ~/.config/cursor:/host-home/.config/cursor:rw
-    profiles:
-      - host
-
-  # ── Profile: cliproxyapi (CLIProxyAPI as sidecar) ─────────────────
-  cliproxyapi:
-    container_name: cliproxyapi
-    image: ghcr.io/router-for-me/cliproxyapi:v6.9.7
-    restart: unless-stopped
+      DATA_DIR: /app/data
+      PORT: "20128"
+      HOSTNAME: "0.0.0.0"
+      NODE_ENV: production
+      HEADROOM_URL: http://headroom:8787
+    depends_on:
+      - headroom
+
+  headroom:
+    image: ghcr.io/chopratejas/headroom:latest
+    container_name: headroom
+    restart: always
     ports:
-      - "${CLIPROXYAPI_PORT:-8317}:${CLIPROXYAPI_PORT:-8317}"
-    volumes:
-      - cliproxyapi-data:/root/.cli-proxy-api
-    environment:
-      - PORT=${CLIPROXYAPI_PORT:-8317}
-      - HOST=0.0.0.0
-    healthcheck:
-      test:
-        ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:${CLIPROXYAPI_PORT:-8317}/v1/models"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-    profiles:
-      - cliproxyapi
+      - "8787:8787"
 
 volumes:
-  cliproxyapi-data:
-    name: cliproxyapi-data
-  redis-data:
-    name: omniroute-redis-data
+  9router-data:
+    name: 9router-data

eslint.config.mjs

@@ -1,102 +1,16 @@
+import { defineConfig, globalIgnores } from "eslint/config";
 import nextVitals from "eslint-config-next/core-web-vitals";
-import tseslint from "typescript-eslint";
 
-/** @type {import("eslint").Linter.Config[]} */
-const eslintConfig = [
+const eslintConfig = defineConfig([
   ...nextVitals,
-  // FASE-02: Security rules (strict everywhere)
-  {
-    rules: {
-      "no-eval": "error",
-      "no-implied-eval": "error",
-      "no-new-func": "error",
-      "no-restricted-imports": [
-        "error",
-        {
-          paths: [
-            {
-              name: "prop-types",
-              message: "PropTypes are deprecated. Use TypeScript types/interfaces instead.",
-            },
-          ],
-        },
-      ],
-    },
-  },
-  // i18n: ham toLowerCase().includes() arama pattern'ini engelle
-  // (Türkçe İ/ı karakterlerini bozar — matchesSearch kullanılmalı).
-  // "warn" (error değil): kuralın eklendiği anda kod tabanında zaten bu pattern'i
-  // kullanan ~19 satır var; aşamalı temizlik için uyarı seviyesinde tutuluyor
-  // (proje politikası: 0 error, warning'ler tolere edilir).
-  {
-    files: ["src/app/**/*.{ts,tsx}", "src/components/**/*.{ts,tsx}"],
-    rules: {
-      "no-restricted-syntax": [
-        "warn",
-        {
-          selector:
-            "CallExpression[callee.property.name='includes'][callee.object.callee.property.name='toLowerCase']",
-          message:
-            "Türkçe-güvenli arama için matchesSearch() kullan (@/shared/utils/turkishText). Ham toLowerCase().includes() İ/ı karakterlerini bozar.",
-        },
-      ],
-    },
-  },
-  // Relaxed rules for open-sse and tests (incremental adoption)
-  {
-    files: ["open-sse/**/*.ts", "tests/**/*.mjs", "tests/**/*.ts"],
-    plugins: {
-      "@typescript-eslint": tseslint.plugin,
-    },
-    rules: {
-      "@typescript-eslint/no-explicit-any": "warn",
-      "@next/next/no-assign-module-variable": "off",
-      "react-hooks/rules-of-hooks": "off",
-    },
-  },
-  // Global ignores — keep ESLint scoped to source files only
-  {
-    ignores: [
-      // Next.js build output (distDir now .build/next; keep .next for legacy)
-      ".next/**",
-      ".build/**",
-      "src/.next/**",
-      "out/**",
-      "build/**",
-      "dist/**",
-      "coverage/**",
-      "next-env.d.ts",
-      // Scripts and binaries
-      "scripts/**",
-      "bin/**",
-      // Dependencies
-      "node_modules/**",
-      ".worktrees/**",
-      // Nested git worktrees created by review/resolve skills live under
-      // .claude/ (gitignored). They hold other sessions' in-progress work and
-      // their files move mid-scan, so never lint them from the main checkout.
-      ".claude/**",
-      ".omnivscodeagent/**",
-      // VS Code extension and its large test fixtures
-      "vscode-extension/**",
-      "_references/**",
-      "_mono_repo/**",
-      // Electron app
-      "electron/**",
-      // Docs
-      "docs/**",
-      // Open-SSE compiled/bundled output
-      "open-sse/mcp-server/dist/**",
-      // Playwright test output
-      "playwright-report/**",
-      "test-results/**",
-      // Legacy app/ and QA backup dirs (renamed to dist/ in Layer 1)
-      "app/**",
-      "app.__qa_backup/**",
-      // CLI package copy directory
-      "clipr/**",
-    ],
-  },
-];
+  // Override default ignores of eslint-config-next.
+  globalIgnores([
+    // Default ignores of eslint-config-next:
+    ".next/**",
+    "out/**",
+    "build/**",
+    "next-env.d.ts",
+  ]),
+]);
 
 export default eslintConfig;

hf-server.js

@@ -0,0 +1,126 @@
+const http = require("http");
+const path = require("path");
+const fs = require("fs");
+const crypto = require("crypto");
+const { pathToFileURL } = require("url");
+
+const origCreate = http.createServer.bind(http);
+
+// HuggingFace Spaces container default
+const PORT = Number(process.env.PORT || 7860);
+const HOSTNAME = process.env.HOSTNAME || "0.0.0.0";
+
+// Per-process secret proving x-9r-real-ip was stamped below rather than sent by the client.
+const PEER_TOKEN = crypto.randomBytes(24).toString("hex");
+process.env.NINEROUTER_PEER_TOKEN = PEER_TOKEN;
+
+let backgroundRefreshStarted = false;
+
+function startBackgroundTokenRefreshFromHfServer() {
+  if (backgroundRefreshStarted) return;
+  backgroundRefreshStarted = true;
+
+  const modPath = path.join(__dirname, "src", "sse", "services", "backgroundTokenRefresh.js");
+  import(pathToFileURL(modPath).href)
+    .then((m) => {
+      try {
+        m.startBackgroundTokenRefresh();
+      } catch (e) {
+        console.error("[BackgroundTokenRefresh] start failed:", e && e.message ? e.message : e);
+      }
+      const stop = () => {
+        try {
+          m.stopBackgroundTokenRefresh();
+        } catch {
+          /* ignore */
+        }
+      };
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+    })
+    .catch((e) => {
+      console.error("[BackgroundTokenRefresh] import failed:", e && e.message ? e.message : e);
+    });
+}
+
+http.createServer = (...args) => {
+  const handler = args.find((a) => typeof a === "function");
+  const rest = args.filter((a) => typeof a !== "function");
+  if (!handler) return origCreate(...args);
+  const wrapped = (req, res) => {
+    const socketIp = req.socket && req.socket.remoteAddress ? req.socket.remoteAddress : "";
+    const xff = req.headers["x-forwarded-for"];
+    const xRealIp = req.headers["x-real-ip"];
+    const viaProxy = !!(xff || xRealIp);
+    const isLoopbackProxy = socketIp === "127.0.0.1" || socketIp === "::1" || socketIp === "::ffff:127.0.0.1";
+    const proxyIp = xRealIp || (xff ? String(xff).split(",")[0].trim() : "");
+    const ip = isLoopbackProxy && proxyIp ? proxyIp : socketIp;
+    delete req.headers["x-9r-real-ip"];
+    delete req.headers["x-forwarded-for"];
+    delete req.headers["x-9r-via-proxy"];
+    delete req.headers["x-9r-peer-token"];
+    req.headers["x-9r-real-ip"] = ip;
+    req.headers["x-9r-peer-token"] = PEER_TOKEN;
+    if (viaProxy) req.headers["x-9r-via-proxy"] = "1";
+    return handler(req, res);
+  };
+  const server = origCreate(...rest, wrapped);
+  server.once("listening", () => {
+    startBackgroundTokenRefreshFromHfServer();
+  });
+  const origEmit = server.emit;
+  server.emit = function (event, ...eventArgs) {
+    const [req, socket, head] = eventArgs;
+    if (event !== "upgrade" || String(req.headers.upgrade || "").toLowerCase() !== "h2c") {
+      return origEmit.call(this, event, ...eventArgs);
+    }
+    const contentLength = Number(req.headers["content-length"] || 0);
+    if (!Number.isSafeInteger(contentLength) || contentLength < 0) {
+      socket.destroy();
+      return true;
+    }
+    const chunks = [head];
+    let received = head.length;
+    const serve = () => {
+      const replay = new http.IncomingMessage(socket);
+      Object.assign(replay, { method: req.method, url: req.url, headers: req.headers, complete: true });
+      if (received) replay.push(Buffer.concat(chunks, received).subarray(0, contentLength));
+      replay.push(null);
+      const res = new http.ServerResponse(replay);
+      res.shouldKeepAlive = false;
+      res.assignSocket(socket);
+      res.once("finish", () => socket.end());
+      Promise.resolve().then(() => wrapped(replay, res)).catch((error) => {
+        console.error("Failed to downgrade h2c request", error);
+        socket.destroy();
+      });
+    };
+    if (received >= contentLength) serve();
+    else {
+      socket.on("data", function readBody(chunk) {
+        chunks.push(chunk);
+        received += chunk.length;
+        if (received < contentLength) return;
+        socket.off("data", readBody);
+        serve();
+      });
+      socket.resume();
+    }
+    delete req.headers.upgrade;
+    delete req.headers["http2-settings"];
+    req.headers.connection = "close";
+    return true;
+  };
+  return server;
+};
+
+if (require.main === module) {
+  const standalone = path.join(__dirname, "server.js");
+  if (fs.existsSync(standalone)) {
+    require(standalone);
+  } else {
+    const nextBin = require.resolve("next/dist/bin/next");
+    process.argv = [process.argv[0], nextBin, "start", "--port", String(PORT), "--hostname", HOSTNAME, ...process.argv.slice(2)];
+    require(nextBin);
+  }
+}

jsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"],
+      "open-sse": ["./open-sse"],
+      "open-sse/*": ["./open-sse/*"]
+    },
+    "module": "ESNext",
+    "moduleResolution": "bundler"
+  }
+}

next.config.mjs

@@ -1,508 +1,98 @@
-import createNextIntlPlugin from "next-intl/plugin";
-import { createMDX } from "fumadocs-mdx/next";
-import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
 
-const withNextIntl = createNextIntlPlugin("./src/i18n/request.ts");
-const distDir = process.env.NEXT_DIST_DIR || ".build/next";
 const projectRoot = dirname(fileURLToPath(import.meta.url));
-const scriptSrc =
-  process.env.NODE_ENV === "development"
-    ? "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:"
-    : "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:";
-const contentSecurityPolicy = [
-  "default-src 'self'",
-  "base-uri 'self'",
-  "object-src 'none'",
-  "frame-ancestors 'none'",
-  "form-action 'self'",
-  scriptSrc,
-  "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
-  "font-src 'self' https://fonts.gstatic.com data:",
-  "img-src 'self' data: blob: https:",
-  "media-src 'self' data: blob:",
-  "connect-src 'self' http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:* https: wss:",
-  "worker-src 'self' blob:",
-  "manifest-src 'self'",
-].join("; ");
-const securityHeaders = [
-  {
-    key: "Content-Security-Policy",
-    value: contentSecurityPolicy,
-  },
-  {
-    key: "X-Frame-Options",
-    value: "DENY",
-  },
-  {
-    key: "X-Content-Type-Options",
-    value: "nosniff",
-  },
-  {
-    key: "Referrer-Policy",
-    value: "strict-origin-when-cross-origin",
-  },
-  {
-    key: "Permissions-Policy",
-    value: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=()",
-  },
-  {
-    key: "Strict-Transport-Security",
-    value: "max-age=63072000; includeSubDomains; preload",
-  },
-];
-
-function isNextIntlExtractorDynamicImportWarning(warning) {
-  const message = typeof warning === "string" ? warning : warning?.message || "";
-  const resource = warning?.module?.resource || warning?.file || "";
-  const target = "next-intl/dist/esm/production/extractor/format/index.js";
-  return (
-    resource.includes(target) &&
-    (message.includes("import(t)") || message.includes("dependency is an expression"))
-  );
-}
-
-// OMNIROUTE_BUILD_PROFILE=minimal physically removes four optional privileged
-// modules (MITM cert install, Zed keychain import, Cloud Sync, 9router
-// installer) from the built bundle by aliasing them to feature-disabled stubs.
-// The resulting artifact is intended to be published as `omniroute-secure`
-// for security-sensitive environments. See docs/security/SOCKET_DEV_FINDINGS.md.
-const isMinimalBuild = process.env.OMNIROUTE_BUILD_PROFILE === "minimal";
-
-const minimalBuildAliases = isMinimalBuild
-  ? {
-      "@/mitm/cert/install": "./src/mitm/cert/install.stub.ts",
-      "@/lib/zed-oauth/keychain-reader": "./src/lib/zed-oauth/keychain-reader.stub.ts",
-      "@/lib/cloudSync": "./src/lib/cloudSync.stub.ts",
-      "@/lib/services/installers/ninerouter": "./src/lib/services/installers/ninerouter.stub.ts",
-    }
-  : {};
+// CLI bundling needs workspace root so tracing includes hoisted node_modules (slim ~50MB).
+// Docker / default uses projectRoot so server.js lands at /app/server.js (not nested).
+const tracingRoot = process.env.NEXT_TRACING_ROOT_MODE === "workspace"
+  ? join(projectRoot, "..")
+  : projectRoot;
+const proxyClientMaxBodySize = process.env.NINEROUTER_PROXY_CLIENT_MAX_BODY_SIZE || "128mb";
 
 /** @type {import('next').NextConfig} */
 const nextConfig = {
-  distDir,
-  // Turbopack config: redirect native modules to stubs at build time
-  turbopack: {
-    root: projectRoot,
-    resolveAlias: {
-      // Point mitm/manager to a stub during build (native child_process/fs can't be bundled)
-      "@/mitm/manager": "./src/mitm/manager.stub.ts",
-      ...minimalBuildAliases,
-    },
-  },
+  distDir: process.env.NEXT_DIST_DIR || ".next",
   output: "standalone",
-  // OmniRoute is a proxy for AI APIs — request bodies routinely include
-  // multi-MB payloads (vision models, image edits, base64-encoded files,
-  // long chat histories with embedded images). Next.js's Server Action
-  // handler intercepts POSTs with multipart/form-data or
-  // x-www-form-urlencoded content-types and enforces a 1 MB cap that
-  // surfaces as a 413 with a confusing "Server Actions" hint, even on
-  // pure route handlers. 50 MB matches what most upstream LLM providers
-  // accept for image-bearing requests; tune via env if a deployment needs
-  // more.
-  experimental: {
-    serverActions: {
-      bodySizeLimit: process.env.OMNIROUTE_SERVER_ACTIONS_BODY_LIMIT || "50mb",
-    },
-    // Next.js proxy (middleware) has a default 10MB body clone limit. File
-    // uploads (OpenAI-compatible /v1/files) routinely exceed this. Match the
-    // 512 MB server-side cap; tune via env if needed.
-    proxyClientMaxBodySize: process.env.NEXT_PROXY_BODY_LIMIT || "512mb",
-  },
-  outputFileTracingRoot: projectRoot,
-  outputFileTracingIncludes: {
-    // Migration SQL and compression rule/filter JSON files are read via fs at
-    // runtime and are NOT always auto-traced by webpack/turbopack.
-    "/*": [
-      "./src/lib/db/migrations/**/*",
-      "./src/mitm/server.cjs",
-      "./open-sse/services/compression/engines/rtk/filters/**/*.json",
-      "./open-sse/services/compression/rules/**/*.json",
-      "./open-sse/lib/sha3_wasm_bg.wasm",
-      "./open-sse/lib/deepseek-pow-solver.cjs",
-    ],
+  // `open` must stay external. It derives its own directory from `import.meta.url`, and
+  // webpack replaces that with the absolute path of the BUILD machine as a string literal.
+  // A release built on macOS therefore ships `file:///Users/.../open/index.js`, which
+  // `fileURLToPath` rejects on Windows ("File URL path must be absolute" — no drive
+  // letter). That throw happens at module scope, so every consumer of `open` dies on
+  // import — including xAI/Grok token refresh, which loads the OAuth service that imports
+  // it. Keeping it external preserves the real `import.meta.url` at runtime.
+  serverExternalPackages: ["better-sqlite3", "sql.js", "node:sqlite", "bun:sqlite", "open"],
+  turbopack: {
+    root: tracingRoot
   },
+  outputFileTracingRoot: tracingRoot,
   outputFileTracingExcludes: {
-    // Planning/task docs are not runtime assets and can break standalone copies
-    // when broad fs/path tracing pulls the whole repository into the NFT graph.
-    "/*": [
-      "./.git/**/*",
-      "./_tasks/**/*",
-      "./_references/**/*",
-      "./_ideia/**/*",
-      "./_mono_repo/**/*",
-      "./coverage/**/*",
-      "./test-results/**/*",
-      "./playwright-report/**/*",
-      "./app.__qa_backup/**/*",
-      "./tests/**/*",
-      "./logs/**/*",
-    ],
+    "*": ["./gitbook/**/*"]
   },
-  serverExternalPackages: [
-    "pino",
-    "pino-pretty",
-    "thread-stream",
-    "pino-abstract-transport",
-    "better-sqlite3",
-    // sqlite-vec ships a native vec0.so loaded at runtime via createRequire().
-    // Turbopack otherwise tries to bundle the .so and fails with "Unknown module
-    // type"; externalizing it keeps the require at runtime (like better-sqlite3).
-    // See issue #3066.
-    "sqlite-vec",
-    "node-machine-id",
-    "keytar",
-    "wreq-js",
-    "zod",
-    "tls-client-node",
-    "koffi",
-    "tough-cookie",
-    "@ngrok/ngrok",
-    "@huggingface/transformers",
-    "child_process",
-    "fs",
-    "path",
-    "os",
-    "crypto",
-    "net",
-    "tls",
-    "http",
-    "https",
-    "stream",
-    "buffer",
-    "util",
-    "process",
-  ],
-  transpilePackages: ["@omniroute/open-sse", "@lobehub/icons", "fumadocs-ui", "fumadocs-core"],
-  allowedDevOrigins: ["localhost", "127.0.0.1", "192.168.0.250"],
-  typescript: {
-    // TODO: Re-enable after fixing all sub-component useTranslations scope issues
-    ignoreBuildErrors: true,
+  images: {
+    unoptimized: true
   },
-  webpack(config, { webpack }) {
-    config.ignoreWarnings = [
-      ...(config.ignoreWarnings || []),
-      isNextIntlExtractorDynamicImportWarning,
-    ];
-    config.optimization = config.optimization || {};
-    config.optimization.splitChunks = {
-      ...config.optimization.splitChunks,
-      cacheGroups: {
-        ...(config.optimization.splitChunks?.cacheGroups || {}),
-        recharts: {
-          test: /[\\/]node_modules[\\/]recharts[\\/]/,
-          name: "vendor-recharts",
-          chunks: "all",
-          priority: 20,
-        },
-        lobeIcons: {
-          test: /[\\/]node_modules[\\/]@lobehub[\\/]icons[\\/]/,
-          name: "vendor-lobe-icons",
-          chunks: "all",
-          priority: 20,
-        },
-        monaco: {
-          test: /[\\/]node_modules[\\/]monaco-editor[\\/]/,
-          name: "vendor-monaco",
-          chunks: "all",
-          priority: 20,
-        },
-        xyflow: {
-          test: /[\\/]node_modules[\\/]@xyflow[\\/]/,
-          name: "vendor-xyflow",
-          chunks: "all",
-          priority: 20,
-        },
-        mermaid: {
-          test: /[\\/]node_modules[\\/]mermaid[\\/]/,
-          name: "vendor-mermaid",
-          chunks: "all",
-          priority: 20,
-        },
-      },
-    };
-
-    if (isMinimalBuild) {
-      // Mirror the turbopack.resolveAlias entries for webpack-built artifacts.
-      // NormalModuleReplacementPlugin swaps the real module for a stub before
-      // webpack resolves it, so the privileged source files are never compiled
-      // into the standalone output.
-      const replacements = [
-        [/^@\/mitm\/cert\/install$/, "./src/mitm/cert/install.stub.ts"],
-        [/^@\/lib\/zed-oauth\/keychain-reader$/, "./src/lib/zed-oauth/keychain-reader.stub.ts"],
-        [/^@\/lib\/cloudSync$/, "./src/lib/cloudSync.stub.ts"],
-        [
-          /^@\/lib\/services\/installers\/ninerouter$/,
-          "./src/lib/services/installers/ninerouter.stub.ts",
-        ],
-      ];
-      for (const [pattern, stubPath] of replacements) {
-        config.plugins.push(
-          new webpack.NormalModuleReplacementPlugin(pattern, (resource) => {
-            resource.request = stubPath;
-          })
-        );
-      }
+  env: {},
+  experimental: {
+    // #1529/#1572: LLM clients can send long context or base64 image payloads through /v1 rewrites.
+    proxyClientMaxBodySize,
+    // Cache fetch responses across HMR refreshes for faster dev reloads.
+    serverComponentsHmrCache: true,
+    // Tree-shake heavy barrel imports to cut compile + bundle size
+    optimizePackageImports: ["@xyflow/react", "@dnd-kit/core", "@dnd-kit/sortable", "material-symbols", "marked"],
+  },
+  webpack: (config, { isServer }) => {
+    // Ignore fs/path modules in browser bundle
+    if (!isServer) {
+      config.resolve.fallback = {
+        ...config.resolve.fallback,
+        fs: false,
+        path: false,
+      };
     }
-
+    // Exclude non-source dirs from watcher to reduce inotify load
+    config.watchOptions = {
+      ...config.watchOptions,
+      aggregateTimeout: 300,
+      ignored: /[\\/](node_modules|\.git|logs|\.next|\.next-cli-build|gitbook|cli|open-sse\.old|tests|docs)[\\/]/,
+    };
     return config;
   },
-  images: {
-    unoptimized: true,
-  },
-
-  async headers() {
-    return [
-      {
-        source: "/:path*",
-        headers: securityHeaders,
-      },
-      // G-10: allow OmniRoute's own dashboard to embed the 9Router UI via our reverse proxy.
-      // `frame-ancestors 'self'` overrides the global `frame-ancestors 'none'` only for this
-      // path. The route is already LOCAL_ONLY (routeGuard.ts) so remote origins cannot reach it.
-      {
-        source: "/dashboard/providers/services/:name/embed/:path*",
-        headers: [{ key: "Content-Security-Policy", value: "frame-ancestors 'self'" }],
-      },
-    ];
-  },
-
-  async redirects() {
-    return [
-      // Dashboard routes
-      {
-        source: "/dashboard/skills",
-        destination: "/dashboard/omni-skills",
-        permanent: true,
-      },
-      // Architecture
-      {
-        source: "/docs/architecture",
-        destination: "/docs/architecture/architecture",
-        permanent: true,
-      },
-      {
-        source: "/docs/authz-guide",
-        destination: "/docs/architecture/authz-guide",
-        permanent: true,
-      },
-      {
-        source: "/docs/codebase-documentation",
-        destination: "/docs/architecture/codebase-documentation",
-        permanent: true,
-      },
-      {
-        source: "/docs/repository-map",
-        destination: "/docs/architecture/repository-map",
-        permanent: true,
-      },
-      {
-        source: "/docs/resilience-guide",
-        destination: "/docs/architecture/resilience-guide",
-        permanent: true,
-      },
-      // Guides
-      { source: "/docs/docker-guide", destination: "/docs/guides/docker-guide", permanent: true },
-      {
-        source: "/docs/electron-guide",
-        destination: "/docs/guides/electron-guide",
-        permanent: true,
-      },
-      { source: "/docs/features", destination: "/docs/guides/features", permanent: true },
-      { source: "/docs/i18n", destination: "/docs/guides/i18n", permanent: true },
-      { source: "/docs/kiro-setup", destination: "/docs/guides/kiro-setup", permanent: true },
-      { source: "/docs/pwa-guide", destination: "/docs/guides/pwa-guide", permanent: true },
-      { source: "/docs/setup-guide", destination: "/docs/guides/setup-guide", permanent: true },
-      { source: "/docs/termux-guide", destination: "/docs/guides/termux-guide", permanent: true },
-      {
-        source: "/docs/troubleshooting",
-        destination: "/docs/guides/troubleshooting",
-        permanent: true,
-      },
-      { source: "/docs/uninstall", destination: "/docs/guides/uninstall", permanent: true },
-      { source: "/docs/user-guide", destination: "/docs/guides/user-guide", permanent: true },
-      // Reference
-      {
-        source: "/docs/api-reference",
-        destination: "/docs/reference/api-reference",
-        permanent: true,
-      },
-      { source: "/docs/cli-tools", destination: "/docs/reference/cli-tools", permanent: true },
-      { source: "/docs/environment", destination: "/docs/reference/environment", permanent: true },
-      { source: "/docs/free-tiers", destination: "/docs/reference/free-tiers", permanent: true },
-      {
-        source: "/docs/provider-reference",
-        destination: "/docs/reference/provider-reference",
-        permanent: true,
-      },
-      // Frameworks
-      { source: "/docs/a2a-server", destination: "/docs/frameworks/a2a-server", permanent: true },
-      {
-        source: "/docs/agent-protocols-guide",
-        destination: "/docs/frameworks/agent-protocols-guide",
-        permanent: true,
-      },
-      { source: "/docs/cloud-agent", destination: "/docs/frameworks/cloud-agent", permanent: true },
-      { source: "/docs/evals", destination: "/docs/frameworks/evals", permanent: true },
-      {
-        source: "/docs/gamification",
-        destination: "/docs/frameworks/gamification",
-        permanent: true,
-      },
-      { source: "/docs/mcp-server", destination: "/docs/frameworks/mcp-server", permanent: true },
-      { source: "/docs/memory", destination: "/docs/frameworks/memory", permanent: true },
-      { source: "/docs/opencode", destination: "/docs/frameworks/opencode", permanent: true },
-      { source: "/docs/skills", destination: "/docs/frameworks/skills", permanent: true },
-      { source: "/docs/webhooks", destination: "/docs/frameworks/webhooks", permanent: true },
-      // Routing
-      { source: "/docs/auto-combo", destination: "/docs/routing/auto-combo", permanent: true },
-      {
-        source: "/docs/reasoning-replay",
-        destination: "/docs/routing/reasoning-replay",
-        permanent: true,
-      },
-      // Security
-      { source: "/docs/cli-token", destination: "/docs/security/cli-token", permanent: true },
-      {
-        source: "/docs/cli-token-auth",
-        destination: "/docs/security/cli-token-auth",
-        permanent: true,
-      },
-      { source: "/docs/compliance", destination: "/docs/security/compliance", permanent: true },
-      {
-        source: "/docs/error-sanitization",
-        destination: "/docs/security/error-sanitization",
-        permanent: true,
-      },
-      { source: "/docs/guardrails", destination: "/docs/security/guardrails", permanent: true },
-      { source: "/docs/public-creds", destination: "/docs/security/public-creds", permanent: true },
-      {
-        source: "/docs/route-guard-tiers",
-        destination: "/docs/security/route-guard-tiers",
-        permanent: true,
-      },
-      {
-        source: "/docs/stealth-guide",
-        destination: "/docs/security/stealth-guide",
-        permanent: true,
-      },
-      // Compression
-      {
-        source: "/docs/compression-engines",
-        destination: "/docs/compression/compression-engines",
-        permanent: true,
-      },
-      {
-        source: "/docs/compression-guide",
-        destination: "/docs/compression/compression-guide",
-        permanent: true,
-      },
-      {
-        source: "/docs/compression-language-packs",
-        destination: "/docs/compression/compression-language-packs",
-        permanent: true,
-      },
-      {
-        source: "/docs/compression-rules-format",
-        destination: "/docs/compression/compression-rules-format",
-        permanent: true,
-      },
-      {
-        source: "/docs/rtk-compression",
-        destination: "/docs/compression/rtk-compression",
-        permanent: true,
-      },
-      // Ops
-      { source: "/docs/coverage-plan", destination: "/docs/ops/coverage-plan", permanent: true },
-      {
-        source: "/docs/e2e-dashboard-shakedown-v3.8.0",
-        destination: "/docs/ops/e2e-dashboard-shakedown-v3.8.0",
-        permanent: true,
-      },
-      {
-        source: "/docs/fly-io-deployment-guide",
-        destination: "/docs/ops/fly-io-deployment-guide",
-        permanent: true,
-      },
-      { source: "/docs/proxy-guide", destination: "/docs/ops/proxy-guide", permanent: true },
-      {
-        source: "/docs/release-checklist",
-        destination: "/docs/ops/release-checklist",
-        permanent: true,
-      },
-      { source: "/docs/sqlite-runtime", destination: "/docs/ops/sqlite-runtime", permanent: true },
-      { source: "/docs/tunnels-guide", destination: "/docs/ops/tunnels-guide", permanent: true },
-      {
-        source: "/docs/vm-deployment-guide",
-        destination: "/docs/ops/vm-deployment-guide",
-        permanent: true,
-      },
-      // CLI Pages — Plano 14 (F9)
-      { source: "/dashboard/cli-tools", destination: "/dashboard/cli-code", permanent: true },
-      {
-        source: "/dashboard/cli-tools/:path*",
-        destination: "/dashboard/cli-code/:path*",
-        permanent: true,
-      },
-      { source: "/dashboard/agents", destination: "/dashboard/acp-agents", permanent: true },
-      {
-        source: "/dashboard/agents/:path*",
-        destination: "/dashboard/acp-agents/:path*",
-        permanent: true,
-      },
-    ];
-  },
-
   async rewrites() {
     return [
-      {
-        source: "/chat/completions",
-        destination: "/api/v1/chat/completions",
-      },
-      {
-        source: "/responses",
-        destination: "/api/v1/responses",
-      },
-      {
-        source: "/responses/:path*",
-        destination: "/api/v1/responses/:path*",
-      },
-      {
-        source: "/models",
-        destination: "/api/v1/models",
-      },
       {
         source: "/v1/v1/:path*",
-        destination: "/api/v1/:path*",
+        destination: "/api/v1/:path*"
       },
       {
         source: "/v1/v1",
-        destination: "/api/v1",
+        destination: "/api/v1"
       },
       {
         source: "/codex/:path*",
-        destination: "/api/v1/responses",
-      },
-      {
-        source: "/v1/:path*",
-        destination: "/api/v1/:path*",
+        destination: "/api/v1/responses"
       },
       {
-        source: "/v1",
-        destination: "/api/v1",
+        source: "/responses",
+        destination: "/api/v1/responses"
       },
       {
         source: "/v1beta/:path*",
-        destination: "/api/v1beta/:path*",
+        destination: "/api/v1beta/:path*"
       },
       {
         source: "/v1beta",
-        destination: "/api/v1beta",
+        destination: "/api/v1beta"
+      },
+      {
+        source: "/v1/:path*",
+        destination: "/api/v1/:path*"
       },
+      {
+        source: "/v1",
+        destination: "/api/v1"
+      }
     ];
-  },
+  }
 };
 
-const withMDX = createMDX();
-
-export default withMDX(withNextIntl(nextConfig));
+export default nextConfig;

package.json

@@ -1,276 +1,67 @@
 {
-  "name": "omniroute",
-  "version": "3.8.13",
-  "description": "Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.",
-  "type": "module",
-  "bin": {
-    "omniroute": "bin/omniroute.mjs",
-    "omniroute-reset-password": "bin/reset-password.mjs"
-  },
-  "files": [
-    "bin/",
-    "dist/",
-    "src/lib/cli-helper/",
-    "@omniroute/",
-    "open-sse/mcp-server/index.ts",
-    "open-sse/mcp-server/server.ts",
-    "open-sse/mcp-server/httpTransport.ts",
-    "open-sse/mcp-server/audit.ts",
-    "open-sse/mcp-server/runtimeHeartbeat.ts",
-    "open-sse/mcp-server/scopeEnforcement.ts",
-    "open-sse/mcp-server/schemas/",
-    "open-sse/mcp-server/tools/",
-    "open-sse/mcp-server/README.md",
-    "open-sse/utils/setupPolyfill.ts",
-    "src/shared/contracts/",
-    "src/shared/utils/nodeRuntimeSupport.ts",
-    ".env.example",
-    "scripts/build/postinstall.mjs",
-    "bin/cli/runtime/",
-    "scripts/postinstall.mjs",
-    "scripts/build/postinstallSupport.mjs",
-    "scripts/build/sync-env.mjs",
-    "scripts/dev/responses-ws-proxy.mjs",
-    "scripts/check/check-supported-node-runtime.ts",
-    "scripts/dev/sync-env.mjs",
-    "scripts/build/native-binary-compat.mjs",
-    "scripts/build/build-next-isolated.mjs",
-    "README.md",
-    "LICENSE"
-  ],
-  "workspaces": [
-    "open-sse"
-  ],
-  "engines": {
-    "node": ">=22.0.0 <23 || >=24.0.0 <27"
-  },
-  "keywords": [
-    "ai",
-    "router",
-    "proxy",
-    "openai",
-    "claude",
-    "anthropic",
-    "gemini",
-    "fallback",
-    "cursor",
-    "cline",
-    "codex",
-    "llm",
-    "auto-fallback"
-  ],
-  "license": "MIT",
-  "author": "diegosouzapw",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/diegosouzapw/OmniRoute"
-  },
-  "homepage": "https://omniroute.online",
+  "name": "9router-app",
+  "version": "0.5.55",
+  "description": "9Router web dashboard",
+  "private": true,
   "scripts": {
-    "dev": "node scripts/dev/run-next.mjs dev",
-    "prebuild:docs": "node scripts/docs/gen-openapi-module.mjs",
-    "gen:provider-reference": "node --import tsx scripts/docs/gen-provider-reference.ts",
-    "build": "node scripts/build/build-next-isolated.mjs",
-    "build:secure": "OMNIROUTE_BUILD_PROFILE=minimal node scripts/build/build-next-isolated.mjs",
-    "build:cli": "node --import tsx scripts/build/prepublish.ts",
-    "build:release": "rm -rf .build dist && OMNIROUTE_BUILD_SHA=$(git rev-parse --short HEAD) npm run build && npm run build:cli && node scripts/build/write-build-sha.mjs",
-    "start": "node scripts/dev/run-next.mjs start",
-    "lint": "eslint .",
-    "electron:dev": "concurrently \"npm run dev\" \"wait-on http://localhost:20128 && cd electron && npm run dev\"",
-    "electron:build": "npm run build && cd electron && npm run build",
-    "electron:build:win": "npm run build && cd electron && npm run build:win",
-    "electron:build:mac": "npm run build && cd electron && npm run build:mac",
-    "electron:build:linux": "npm run build && cd electron && npm run build:linux",
-    "electron:smoke:packaged": "node scripts/dev/smoke-electron-packaged.mjs",
-    "test": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --test --test-concurrency=20 tests/unit/*.test.ts",
-    "test:unit": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --test --test-force-exit --test-concurrency=20 tests/unit/*.test.ts",
-    "test:unit:fast": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --test --test-force-exit --test-isolation=none tests/unit/*.test.ts",
-    "test:unit:shard": "concurrently --kill-others-on-fail -n s1,s2 \"npm:test:unit:shard:1\" \"npm:test:unit:shard:2\"",
-    "test:unit:shard:1": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --test --test-force-exit --test-concurrency=10 --test-shard=1/2 tests/unit/*.test.ts",
-    "test:unit:shard:2": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --test --test-force-exit --test-concurrency=10 --test-shard=2/2 tests/unit/*.test.ts",
-    "test:plan3": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx --import ./open-sse/utils/setupPolyfill.ts --test tests/unit/plan3-p0.test.ts",
-    "test:fixes": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx --import ./open-sse/utils/setupPolyfill.ts --test tests/unit/fixes-p1.test.ts",
-    "test:security": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx --import ./open-sse/utils/setupPolyfill.ts --test tests/unit/security-fase01.test.ts",
-    "check:cycles": "node scripts/check/check-cycles.mjs",
-    "check:route-validation:t06": "node scripts/check/check-route-validation.mjs",
-    "check:any-budget:t11": "node scripts/check/check-t11-any-budget.mjs",
-    "check:docs-sync": "node scripts/check/check-docs-sync.mjs",
-    "check:env-doc-sync": "node scripts/check/check-env-doc-sync.mjs",
-    "check:docs-counts": "node scripts/check/check-docs-counts-sync.mjs",
-    "check:deprecated-versions": "node scripts/check/check-deprecated-versions.mjs",
-    "check:doc-links": "node scripts/check/check-doc-links.mjs",
-    "check:docs-all": "npm run check:docs-sync && npm run check:docs-counts && npm run check:env-doc-sync && npm run check:deprecated-versions && npm run check:doc-links",
-    "docs:render-diagrams": "node scripts/docs/render-diagrams.mjs",
-    "i18n:run": "node scripts/i18n/run-translation.mjs",
-    "i18n:run:dry": "node scripts/i18n/run-translation.mjs --dry-run",
-    "i18n:check": "node scripts/i18n/check-translation-drift.mjs",
-    "i18n:sync-ui": "node scripts/i18n/sync-ui-keys.mjs",
-    "i18n:sync-ui:dry": "node scripts/i18n/sync-ui-keys.mjs --dry-run",
-    "i18n:check-ui-coverage": "node scripts/i18n/check-ui-keys-coverage.mjs",
-    "check:node-runtime": "node --import tsx scripts/check/check-supported-node-runtime.ts",
-    "check:pack-artifact": "node --import tsx scripts/build/validate-pack-artifact.ts",
-    "audit:deps": "npm audit --audit-level=moderate && npm run audit:electron",
-    "audit:electron": "npm --prefix electron audit --audit-level=moderate",
-    "typecheck:core": "tsc --pretty false -p tsconfig.typecheck-core.json",
-    "typecheck:noimplicit:core": "tsc --pretty false -p tsconfig.typecheck-noimplicit-core.json",
-    "backfill-aggregation": "node --import tsx src/scripts/backfillAggregation.ts",
-    "env:sync": "node scripts/dev/sync-env.mjs",
-    "test:integration": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx --import ./open-sse/utils/setupPolyfill.ts --test --test-force-exit --test-concurrency=1 tests/integration/*.test.ts",
-    "test:e2e": "node scripts/dev/run-playwright-tests.mjs test tests/e2e/*.spec.ts",
-    "test:protocols:e2e": "node scripts/dev/run-protocol-clients-tests.mjs",
-    "test:vitest": "vitest run --config vitest.mcp.config.ts",
-    "test:vitest:ui": "vitest run --config vitest.config.ts tests/unit/ui",
-    "test:ecosystem": "node scripts/dev/run-ecosystem-tests.mjs",
-    "test:system": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx --import ./open-sse/utils/setupPolyfill.ts --test --test-force-exit --test-concurrency=1 tests/e2e/system-failover.test.ts",
-    "test:coverage": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true c8 --output-dir coverage --exclude=tests/** --exclude=**/*.test.* --reporter=text-summary --reporter=html --reporter=json-summary --reporter=lcov --check-coverage --statements 60 --lines 60 --functions 60 --branches 60 node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --test --test-force-exit --test-concurrency=8 tests/unit/*.test.ts",
-    "test:coverage:legacy": "c8 --output-dir coverage --exclude=open-sse --check-coverage --lines 50 --functions 50 --branches 50 node --import tsx --test tests/unit/*.test.ts",
-    "coverage:report": "c8 report --output-dir coverage --exclude=tests/** --exclude=**/*.test.* --reporter=text --reporter=text-summary --reporter=html --reporter=json-summary --reporter=lcov",
-    "coverage:summary": "node scripts/check/test-report-summary.mjs --input coverage/coverage-summary.json --output coverage/coverage-report.md",
-    "check:pr-test-policy": "node scripts/check/check-pr-test-policy.mjs",
-    "coverage:report:legacy": "c8 report --output-dir coverage --exclude=open-sse --reporter=text --reporter=text-summary",
-    "test:all": "npm run test:unit && npm run test:vitest && npm run test:vitest:ui && npm run test:ecosystem && npm run test:e2e",
-    "check": "npm run lint && npm run test",
-    "prepublishOnly": "npm run build:cli-api && npm run build:cli && npm run check:pack-artifact",
-    "postinstall": "node scripts/build/postinstall.mjs",
-    "uninstall": "node scripts/build/uninstall.mjs",
-    "uninstall:full": "node scripts/build/uninstall.mjs --full",
-    "prepare": "husky",
-    "system-info": "node scripts/dev/system-info.mjs",
-    "build:cli-api": "node --import tsx/esm scripts/cli/generate-api-commands.mjs"
+    "dev": "next dev --port 20127",
+    "dev:webpack": "next dev --webpack --port 20127",
+    "build": "next build --webpack",
+    "postbuild": "node scripts/copy-standalone-assets.mjs",
+    "postbuild:bun": "node scripts/copy-standalone-assets.mjs",
+    "start": "node custom-server.js --port 20127",
+    "start:hf": "node hf-server.js",
+    "build:hf": "next build --webpack",
+    "dev:bun": "bun --bun next dev --webpack --port 20127",
+    "build:bun": "bun --bun next build --webpack",
+    "start:bun": "bun ./.next/standalone/custom-server.js",
+    "cli:pack": "npm --prefix cli run pack:cli",
+    "cli:publish": "npm --prefix cli run publish:cli"
   },
   "dependencies": {
-    "@aws-sdk/client-bedrock-runtime": "^3.1045.0",
     "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/modifiers": "^9.0.0",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@huggingface/transformers": "^4.2.0",
-    "@libsql/client": "^0.14.0",
-    "@lobehub/icons": "^5.8.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
     "@monaco-editor/react": "^4.7.0",
-    "@ngrok/ngrok": "^1.7.0",
-    "@swc/helpers": "0.5.23",
-    "@types/mdx": "^2.0.13",
-    "@xyflow/react": "^12.10.2",
-    "axios": "^1.16.1",
+    "@next/third-parties": "^16.2.9",
+    "@node-saml/node-saml": "^5.1.0",
+    "@xyflow/react": "^12.10.1",
     "bcryptjs": "^3.0.3",
-    "bottleneck": "^2.19.5",
-    "commander": "^15.0.0",
-    "csv-stringify": "^6.7.0",
+    "chalk": "^5.6.2",
+    "confbox": "^0.2.4",
     "express": "^5.2.1",
-    "fetch-socks": "^1.3.3",
-    "fflate": "^0.8.3",
-    "fumadocs-core": "^16.9.0",
-    "fumadocs-mdx": "^15.0.7",
-    "fumadocs-ui": "^16.9.0",
-    "gray-matter": "^4.0.3",
-    "http-proxy-middleware": "^4.0.0",
-    "https-proxy-agent": "^9.0.0",
-    "ink": "^7.0.3",
-    "ink-spinner": "^5.0.0",
-    "ink-text-input": "^6.0.0",
-    "ioredis": "^5.10.1",
-    "jose": "^6.2.3",
-    "js-yaml": "^4.1.1",
-    "jsonc-parser": "^3.3.1",
-    "lowdb": "^7.0.1",
-    "lucide-react": "^1.16.0",
-    "marked": "^18.0.4",
-    "marked-terminal": "^7.3.0",
-    "mermaid": "^11.15.0",
+    "http-proxy-middleware": "^3.0.5",
+    "jose": "^6.1.3",
+    "marked": "^18.0.1",
+    "material-symbols": "^0.44.6",
     "monaco-editor": "^0.55.1",
-    "next": "^16.2.6",
-    "next-intl": "^4.12.0",
-    "next-themes": "^0.4.6",
+    "next": "^16.1.6",
+    "node-forge": "^1.3.3",
     "node-machine-id": "^1.1.12",
     "open": "^11.0.0",
-    "ora": "^9.4.0",
-    "parse5": "^8.0.1",
-    "pino": "^10.3.1",
-    "pino-abstract-transport": "^3.0.0",
-    "pino-pretty": "^13.1.3",
-    "playwright": "1.60.0",
-    "react": "19.2.7",
-    "react-dom": "19.2.7",
-    "react-is": "^19.2.6",
-    "react-markdown": "^10.1.0",
-    "react-reconciler": "^0.33.0",
-    "recharts": "^3.8.1",
+    "ora": "^9.1.0",
+    "prop-types": "^15.8.1",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
+    "react-is": "^16.13.1",
+    "recharts": "^3.7.0",
     "selfsigned": "^5.5.0",
+    "socks-proxy-agent": "^8.0.5",
     "sql.js": "^1.14.1",
-    "sqlite-vec": "^0.1.9",
-    "tsx": "^4.22.3",
-    "undici": "^8.3.0",
-    "update-notifier": "^7.3.1",
-    "uuid": "^14.0.0",
-    "ws": "^8.18.0",
-    "xxhash-wasm": "^1.1.0",
-    "yazl": "^3.3.1",
-    "zod": "^4.4.3",
-    "zustand": "^5.0.13"
+    "undici": "^7.19.2",
+    "uuid": "^13.0.0",
+    "zustand": "^5.0.10"
   },
   "optionalDependencies": {
-    "better-sqlite3": "^12.10.0",
-    "keytar": "^7.9.0",
-    "tls-client-node": "^0.1.13",
-    "wreq-js": "^2.3.1"
+    "better-sqlite3": "^12.6.2"
   },
+  "comment_better_sqlite3": "kept in optionalDependencies so npm install doesn't fail on systems without build tools — sql.js is used as fallback at runtime",
   "devDependencies": {
-    "@playwright/test": "^1.60.0",
-    "@tailwindcss/postcss": "^4.3.0",
-    "@testing-library/jest-dom": "^6.9.1",
-    "@testing-library/react": "^16.3.2",
-    "@types/bcryptjs": "^3.0.0",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/bun": "latest",
-    "@types/keytar": "^4.4.2",
-    "@types/node": "^25.9.1",
-    "@types/react": "^19.2.15",
-    "@types/react-dom": "^19.2.3",
-    "@types/ws": "^8.18.0",
-    "@vitejs/plugin-react": "^6.0.2",
-    "c8": "^11.0.0",
-    "concurrently": "^9.2.1",
-    "cross-env": "^10.1.0",
-    "eslint": "^9.39.4",
-    "eslint-config-next": "16.2.7",
-    "glob": "^13.0.6",
-    "husky": "^9.1.7",
-    "jsdom": "^29.1.1",
-    "lint-staged": "^17.0.5",
-    "node-loader": "^2.1.0",
-    "prettier": "^3.8.3",
-    "tailwindcss": "^4.3.0",
-    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.4",
-    "vitest": "^4.1.7",
-    "wait-on": "^9.0.10",
-    "wtfnode": "^0.10.1"
-  },
-  "lint-staged": {
-    "*.{js,jsx,ts,tsx,mjs}": [
-      "prettier --write",
-      "eslint --fix --no-error-on-unmatched-pattern"
-    ],
-    "*.{json,md,yml,yaml,css}": [
-      "prettier --write"
-    ]
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@parcel/watcher",
-      "@swc/core",
-      "better-sqlite3",
-      "esbuild",
-      "omniroute",
-      "sharp"
-    ]
-  },
-  "overrides": {
-    "dompurify": "^3.4.3",
-    "postcss": "^8.5.14",
-    "ip-address": "10.2.0",
-    "qs": "^6.15.2",
-    "uuid": "^14.0.0"
+    "@tailwindcss/postcss": "^4.1.18",
+    "eslint": "^9",
+    "eslint-config-next": "16.1.6",
+    "postcss": "^8.5.6",
+    "tailwindcss": "^4"
   }
 }

postcss.config.mjs

@@ -1,7 +1,12 @@
-const postcssConfig = {
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const projectRoot = path.dirname(fileURLToPath(import.meta.url));
+
+export default {
   plugins: {
-    "@tailwindcss/postcss": {},
+    "@tailwindcss/postcss": {
+      base: projectRoot,
+    },
   },
 };
-
-export default postcssConfig;

start.sh

@@ -0,0 +1,4 @@
+docker stop 9router
+docker rm 9router
+docker build -t 9router .
+docker run -d --name 9router -p 20128:20128 --env-file .env -v 9router-data:/app/data 9router