Release v3.7.9 (diegosouzapw#1917)

* chore(release): v3.7.9 — gemini-cli cloud code separation

* chore(provider): Update Jina AI model catalog (diegosouzapw#1874)

Integrated into release/v3.7.9

* docs: update CHANGELOG for PR 1874 and retroactive credits

* fix: resolve stream defaults and codex prompt mapping (diegosouzapw#1873, diegosouzapw#1872)

* chore(compression): start caveman compression update

* feat(compression): expand caveman compression and analytics pipeline

Add caveman intensity levels, output mode instructions, validation, and
preview diffs across the compression pipeline.

Extend MCP and dashboard settings to support auto-trigger mode, system
prompt preservation, MCP description compression, and caveman rule
metadata. Record richer compression analytics with receipt fields,
validation fallbacks, output mode data, and add the related database
migration.

Improve preservation handling for code, URLs, markdown, math, and other
protected content while adding broad unit, integration, and golden-set
coverage for caveman parity and compression behavior.

* feat(compression): expose rule intensities and track usd savings

Add estimated USD savings to compression analytics so saved tokens can
be reported in cost terms alongside existing token metrics.

Expose caveman rule intensity metadata for settings consumers and add a
settings API route alias for rule lookup. Also preserve system prompts
when aggressive compression falls back to lite mode.

* feat(compression): RTK compression roadmap (diegosouzapw#1889)

* chore(rtk): initialize compression roadmap branch

* feat(compression): add RTK engine and compression combos

Introduce RTK command-aware tool-output compression alongside
stacked RTK -> Caveman pipelines for mixed prompt contexts.

Add engine registration, declarative RTK filter packs, language-aware
Caveman rule loading, compression combo persistence and assignments,
analytics grouped by engine/combo, and new MCP/API endpoints for
configuration, previews, filters, and combo management.

Expose the new capabilities in the dashboard with dedicated Context &
Cache pages for Caveman, RTK, and compression combos, and update docs,
i18n strings, migrations, and tests to cover the expanded compression
surface.

* feat(compression): expand RTK DSL, filter catalog, and recovery APIs

Add RTK parity features across the compression pipeline, dashboard,
and management APIs. This expands the built-in filter catalog, adds
trust-gated custom filter loading, inline filter verification, code
stripping, smarter detection, and optional redacted raw-output
retention for authenticated recovery.

Also extend Caveman with file-based multilingual rule packs, localized
output-mode instructions, stricter preview/config schemas, engine
registry metadata, analytics fields, and broad unit test coverage for
RTK, rule loading, and stacked compression behavior.

* fix(auth): protect oauth routes and health reset operations

Require authenticated dashboard access for OAuth endpoints that can
create or import provider connections when login enforcement is
enabled.

Move `/api/monitoring/health` to the readonly public route list so
safe methods remain public while DELETE now returns 401 for anonymous
requests.

Also update Next.js native `.node` handling to avoid webpack parse
failures from external packages such as ngrok and keytar, and add
coverage for the new auth behavior.

* build(compression): ship RTK rule and filter assets with app bundles

Include compression JSON assets in Next output tracing, prepublish copies,
and pack artifact policy checks so standalone and packaged builds can
load RTK filters and caveman rule packs at runtime.

Also harden compression runtime behavior by resolving alternate asset
directories, scoping rule cache entries by source path, carrying RTK raw
output pointers through stacked runs, degrading oversized preview diffs,
and applying combo language/output mode defaults during chat routing.

Add coverage for packaging rules, provider-scoped model parsing, smart
truncate edge cases, raw output retention, and combo-driven compression
behavior.

* docs(workflows): update local repo paths to OmniRoute

Replace outdated `/home/diegosouzapw/dev/proxys/9router` references
with the current `OmniRoute` directory across deploy, release, and
version bump workflow guides so local command examples match the
renamed repository layout

* feat(compression): complete RTK parity coverage

* test(build): align next config assertions

---------

Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>

* feat(compression): expand caveman parity and MCP metadata compression

Compress MCP registry and list metadata descriptions for tools, prompts,
resources, and resource templates while keeping tool-response bodies
unchanged. Expose those savings in compression status as
`mcp_metadata_estimate` metadata rather than provider usage.

Add Caveman rule-pack support for custom regex flags and match-specific
replacement maps, update English rules for upstream parity, and tighten
article and pleasantry handling. Also process RTK multipart text blocks
independently so mixed media content compresses safely without
duplicating output.

* feat(compression): unify config validation and persist MCP savings

Centralize compression config schemas across settings, preview, RTK,
and combo APIs to enforce consistent validation for stacked pipelines
and engine-specific options.

Expand caveman and stacked compression behavior by applying default
combos at runtime, surfacing validation and fallback metadata, and
exposing aggressive and ultra adapter schemas for configuration UI and
tests.

Persist MCP description compression snapshots into analytics without
counting them as provider usage, and extend the dashboard with the new
RTK controls and localized labels.

* fix(auth): require dashboard management auth for compression preview

Block preview requests unless they come from a valid management session
token so protected settings cannot be probed through the preview API.

Add unit coverage for unauthenticated requests, invalid bearer tokens,
and successful authenticated preview execution.

* fix(compression): preserve stacked defaults and secure metadata routes

Only apply saved default compression combos when they contain a stacked
pipeline so seeded Caveman-only defaults do not replace the builtin
stacked behavior.

Also require management auth for compression language pack and rules
metadata endpoints, and defer usage receipt attachment until compression
analytics writes have completed to keep analytics records consistent.

* fix(compression): align seeded standard savings combo with stacked default

Update the seeded default compression combo to use the RTK then
Caveman pipeline in both fresh installs and upgraded databases.

Add a targeted migration and runtime guard that only rewrites the
legacy seeded record when its original metadata and single-step
pipeline still match, preserving user-customized default combos.
Refresh docs and tests to reflect the stacked default and expanded
RTK filter catalog.

* docs(compression): document RTK+Caveman stacked savings ranges

Refresh the compression docs and README to describe the default
stacked pipeline in terms of eligible-context savings instead of the
older generic token-saving range.

Add upstream RTK and Caveman benchmark references, explain the
multiplicative savings math behind the stacked default, and update
feature summaries plus package metadata to match the revised
positioning.

* feat(image-gen): add NanoGPT image generation provider (diegosouzapw#1899)

Integrated into release/v3.7.9

* fix(codex): sanitize raw responses input (diegosouzapw#1895)

Integrated into release/v3.7.9

* Fix combo provider breaker profile handling (diegosouzapw#1891)

Integrated into release/v3.7.9

* fix(combos): align strategy contracts (diegosouzapw#1892)

Integrated into release/v3.7.9

* feat(proxy): move proxy configuration to dedicated System → Proxy page (diegosouzapw#1907)

Integrated into release/v3.7.9

* feat: add K/M/B/T cost shortener to prevent UI overflow (diegosouzapw#1902)

Integrated into release/v3.7.9

* feat(providers): implement bulk paste for extra API keys (diegosouzapw#1916)

Integrated into release/v3.7.9

* fix(migrations): treat duplicate-column ALTER as no-op (diegosouzapw#1886)

Integrated into release/v3.7.9

* fix(analytics): robust model pricing resolution, dark mode charts and SQL aggregation fixes (diegosouzapw#1896)

Integrated into release/v3.7.9 (migration renumbered to 044)

* fix(oauth): per-connection mutex for rotating refresh tokens (diegosouzapw#1885)

Integrated into release/v3.7.9

* fix: resolve 3 bugs — Codex tool normalization (diegosouzapw#1914), image gen proxy (diegosouzapw#1904), zero-arg MCP tools (diegosouzapw#1898)

- fix(codex): flatten Chat Completions tool format to Responses format in
  normalizeCodexTools. Prevents 'Missing required parameter: tools[0].name'
  upstream errors when clients send {type:'function', function:{name,...}}
  instead of {type:'function', name,...}.

- fix(proxy): add proxy-aware execution context to image generation route.
  Image requests now correctly use proxy settings from the connection's
  ProxyRegistry assignment, matching the pattern used by chat pipeline.

- fix(translator): inject properties:{} into zero-argument MCP tool schemas
  during Anthropic→OpenAI translation. OpenAI strict mode requires explicit
  properties even for empty object schemas.

Closes diegosouzapw#1914, Closes diegosouzapw#1904, Closes diegosouzapw#1898

* chore(release): v3.7.9 — all changes in ONE commit

* fix: allow local ollama provider connections (diegosouzapw#1893)

* fix(copilot): emit compatible reasoning text deltas (diegosouzapw#1919)

Integrated into release/v3.7.9

* fix(api-manager): show validation errors inline in modals, not behind backdrop (diegosouzapw#1920)

Integrated into release/v3.7.9

* docs: update changelog and pr body with merged prs

* fix(providers): route agentrouter through anthropic endpoint headers

Update the AgentRouter provider registry to use the Claude-compatible
messages API and required Anthropic-style authentication headers. This
bypasses unauthorized_client_error responses and exposes the supported
model list through passthrough configuration.

Also update the changelog and release PR notes to document the fix for
diegosouzapw#1921

* feat(logs): show compression tokens in request log UI (diegosouzapw#1923)

* docs: add PR diegosouzapw#1923 to changelog

---------

Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: Aculeasis <42580940+Aculeasis@users.noreply.github.com>
Co-authored-by: Raxxoor <manker_lol@hotmail.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Tubagus <54710482+0xtbug@users.noreply.github.com>
Co-authored-by: smartenok-ops <smartenok@gmail.com>
Co-authored-by: Gi99lin <74502520+Gi99lin@users.noreply.github.com>
Co-authored-by: ivan-mezentsev <ivan@mezentsev.me>
Co-authored-by: Andrew Munsell <andrew@wizardapps.net>

Author: 11 people

.agents/workflows/deploy-vps-akamai.md

@@ -17,7 +17,7 @@ Deploy OmniRoute to the Akamai VPS using `npm pack + scp` + PM2.
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
 ```
 
 ### 2. Copy to Akamai VPS and install

.agents/workflows/deploy-vps-both.md

@@ -22,7 +22,7 @@ Deploy OmniRoute to the production VPSs using `npm pack + scp` + PM2.
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
 ```
 
 ### 2. Copy to both VPS and install

.agents/workflows/deploy-vps-local.md

@@ -17,7 +17,7 @@ Deploy OmniRoute to the Local VPS using `npm pack + scp` + PM2.
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
 ```
 
 ### 2. Copy to Local VPS and install

.agents/workflows/generate-release.md

@@ -226,7 +226,7 @@ git checkout main
 git pull origin main
 
 # Build and pack locally
-cd /home/diegosouzapw/dev/proxys/9router && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
 
 # Deploy to LOCAL VPS (192.168.0.15)
 scp omniroute-*.tgz root@192.168.0.15:/tmp/

.agents/workflows/version-bump.md

@@ -20,7 +20,7 @@ Automatically bump the project version, generate CHANGELOG entries from git hist
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router
+cd /home/diegosouzapw/dev/proxys/OmniRoute
 CURRENT_VERSION=$(node -p "require('./package.json').version")
 LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
 CURRENT_BRANCH=$(git branch --show-current)
@@ -64,7 +64,7 @@ npm version "$VERSION" --no-git-tag-version
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router
+cd /home/diegosouzapw/dev/proxys/OmniRoute
 LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null)
 echo "=== Commits since $LAST_TAG ==="
 git log "$LAST_TAG"..HEAD --pretty=format:"%h %s" --no-merges | head -100
@@ -133,7 +133,7 @@ The date must be today's date in `YYYY-MM-DD` format.
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router
+cd /home/diegosouzapw/dev/proxys/OmniRoute
 VERSION=$(node -p "require('./package.json').version")
 
 # Update docs/openapi.yaml version
@@ -156,7 +156,7 @@ echo "✓ All workspace packages synced to $VERSION"
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router
+cd /home/diegosouzapw/dev/proxys/OmniRoute
 VERSION=$(node -p "require('./package.json').version")
 OLD_VERSION_PATTERN='[0-9]\+\.[0-9]\+\.[0-9]\+'
 
@@ -174,7 +174,7 @@ echo "✓ llm.txt → $VERSION"
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router
+cd /home/diegosouzapw/dev/proxys/OmniRoute
 npm install
 echo "✓ Lock file regenerated"
 ```
@@ -236,7 +236,7 @@ For each file in `docs/` (excluding `docs/i18n/`), review if CHANGELOG changes a
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router
+cd /home/diegosouzapw/dev/proxys/OmniRoute
 npm run lint
 ```
 
@@ -245,7 +245,7 @@ npm run lint
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router
+cd /home/diegosouzapw/dev/proxys/OmniRoute
 npm test
 ```
 
@@ -254,7 +254,7 @@ npm test
 // turbo
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router
+cd /home/diegosouzapw/dev/proxys/OmniRoute
 VERSION=$(node -p "require('./package.json').version")
 echo "Expected version: $VERSION"
 echo ""
@@ -299,7 +299,7 @@ grep "^## \[" CHANGELOG.md | head -2
 // turbo-all
 
 ```bash
-cd /home/diegosouzapw/dev/proxys/9router
+cd /home/diegosouzapw/dev/proxys/OmniRoute
 git add -A
 VERSION=$(node -p "require('./package.json').version")
 git commit -m "chore(release): bump to v$VERSION — changelog, docs, version sync"

AGENTS.md

@@ -6,7 +6,7 @@ Unified AI proxy/router — route any LLM through one endpoint. Multi-provider s
 with **160+ providers** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
 Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
 SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
-with **MCP Server** (29 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
+with **MCP Server** (37 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
 
 ## Stack
 
@@ -292,17 +292,28 @@ compression pipeline), and more.
 
 Modular prompt compression that runs proactively before the existing reactive context manager.
 
-- **`strategySelector.ts`**: Selects compression mode based on config, combo overrides, auto-trigger
-  thresholds. Priority: combo override > auto-trigger > default mode > off.
+- **`strategySelector.ts`**: Selects compression mode based on config, compression combo assignments,
+  combo overrides, auto-trigger thresholds, and defaults. Priority: assigned compression combo >
+  combo override > auto-trigger > default mode > off.
 - **`lite.ts`**: 5 lite-mode techniques: `collapseWhitespace`, `dedupSystemPrompt`,
   `compressToolResults`, `removeRedundantContent`, `replaceImageUrls`. Target: 10-15% savings at
   <1ms latency.
+- **`caveman.ts` / `cavemanRules.ts`**: Caveman-style semantic condensation backed by built-in
+  rules plus file-loaded language packs under `compression/rules/`.
+- **`engines/rtk/`**: Rule-based terminal/tool-output compression inspired by RTK patterns. Detects
+  command output classes, applies JSON filter packs, deduplicates repeated lines, strips ANSI/code
+  noise, and preserves errors/actionable context. The RTK JSON DSL supports replace,
+  match-output short-circuit, strip/keep, per-line truncation, head/tail/max-line truncation,
+  inline tests, trust-gated project/global custom filters, and optional redacted raw-output
+  retention for authenticated recovery.
+- **`engines/registry.ts`**: Registers engines (`caveman`, `rtk`) and powers stacked pipelines.
 - **`stats.ts`**: Per-request compression stats tracking (original tokens, compressed tokens,
-  savings %, techniques used).
-- **`types.ts`**: `CompressionMode` (off/lite/standard/aggressive/ultra), `CompressionConfig`,
-  `CompressionStats`, `CompressionResult`.
-- DB settings in `src/lib/db/compression.ts`, API route at `src/app/api/settings/compression/`.
-- Phase 1 implements lite mode only; standard/aggressive/ultra are placeholders for Phase 2.
+  savings %, techniques used, engine breakdown, compression combo id).
+- **`types.ts`**: `CompressionMode` (off/lite/standard/aggressive/ultra/rtk/stacked),
+  `CompressionConfig`, `CompressionStats`, `CompressionResult`.
+- DB settings in `src/lib/db/compression.ts`, compression combos in
+  `src/lib/db/compressionCombos.ts`, API routes under `src/app/api/settings/compression/`,
+  `src/app/api/context/*`, and preview/language-pack routes under `src/app/api/compression/*`.
 
 #### Combo Routing Engine (`combo.ts`)
 
@@ -323,7 +334,7 @@ Policy engine modules: `policyEngine.ts`, `comboResolver.ts`, `costRules.ts`,
 
 ### MCP Server (`open-sse/mcp-server/`)
 
-29 tools, 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (10 scopes), Zod schemas.
+37 tools, 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (10 scopes), Zod schemas.
 
 **Core tools** (20): get_health, list_combos, get_combo_metrics, switch_combo, check_quota,
 route_request, cost_report, list_models_catalog, web_search, simulate_route, set_budget_guard,
@@ -332,6 +343,11 @@ best_combo_for_task, explain_route, get_session_snapshot, db_health_check, sync_
 
 **Cache tools** (2): cache_stats, cache_flush.
 
+**Compression tools** (5): compression_status, compression_configure, set_compression_engine,
+list_compression_combos, compression_combo_stats.
+
+**1proxy tools** (3): oneproxy_fetch, oneproxy_rotate, oneproxy_stats.
+
 **Memory tools** (3): memory_search, memory_add, memory_clear.
 
 **Skill tools** (4): skills_list, skills_enable, skills_execute, skills_executions.

CHANGELOG.md

@@ -2,6 +2,55 @@
 
 ## [Unreleased]
 
+## [3.7.9] — 2026-05-03
+
+### ✨ New Features
+
+- **feat(compression):** major upgrade to Caveman and RTK compression pipelines (#1876, #1889):
+  - Add RTK tool-output compression, stacked Caveman + RTK pipelines, compression combo assignments, dashboard context pages, MCP management tools, and language-aware Caveman rule packs.
+  - Expand RTK parity with a 39-filter catalog, RTK-style JSON DSL stages, inline verify/benchmark coverage, trust-gated custom filters, expanded command detection, and redacted raw-output recovery.
+  - Expose rule intensities, track USD savings, unify config validation, and persist MCP savings.
+  - Expand Caveman parity and MCP metadata compression.
+- **feat(provider):** update Jina AI model catalog to support Embeddings and Rerank natively (#1874 — thanks @backryun)
+- **feat(provider):** add NanoGPT image generation provider (#1899 — thanks @Aculeasis)
+- **feat(ui):** move proxy configuration to dedicated System → Proxy page (#1907 — thanks @oyi77)
+- **feat(ui):** add K/M/B/T cost shortener utility (#1902 — thanks @oyi77)
+- **feat(providers):** implement bulk paste for extra API keys (#1916 — thanks @0xtbug)
+- **feat(analytics):** usage history API key backfill + dark mode pricing (#1896 — thanks @Gi99lin)
+- **feat(logs):** show RTK and Caveman compression token savings accurately in request log UI (#1923 — thanks @emdash)
+
+### 🐛 Bug Fixes
+
+- **fix(providers):** allow local OpenAI-compatible endpoints (like Ollama) to be added without an API key (fixes #1893)
+- **fix(providers):** bypass AgentRouter unauthorized_client_error by spoofing Claude CLI headers via Anthropic endpoints (fixes #1921)
+- **fix(copilot):** emit compatible reasoning text deltas (#1919 — thanks @ivan-mezentsev)
+- **fix(api-manager):** show validation errors inline in modals, not behind (#1920 — thanks @andrewmunsell)
+- **fix(compression):** align seeded standard savings combo with stacked default, preserve stacked defaults, and secure metadata routes.
+- **fix(gemini-cli):** separate Cloud Code transport from Antigravity (#1869 — thanks @dhaern)
+- **fix(codex):** map prompt field to input array for Cursor compatibility (fixes #1872)
+- **fix(core):** align stream parameter default to false per strict OpenAI spec (fixes #1873)
+- **fix(ui):** restore Next.js CSP `unsafe-eval` in production `script-src` to fix unresponsive Onboarding button (fixes #1883)
+- **fix(proxy):** globally strip `prompt_cache_retention` in `BaseExecutor` to prevent upstream 400 errors from strict endpoints like droid/gemini-2-pro (fixes #1884)
+- **fix(ui):** include `isOpen` dependency in `EditConnectionModal` state sync to ensure `maxConcurrent` is properly hydrated when reopening the modal (fixes #1859)
+- **fix(security):** remediate 4 polynomial-redos CodeQL alerts in compression regexes by bounding repetitions and removing overlapping quantifiers
+- **fix(codex):** flatten Chat Completions tool format to Codex Responses format in `normalizeCodexTools` — prevents `Missing required parameter: tools[0].name` upstream errors (#1914 — thanks @tranduykhanh030)
+- **fix(proxy):** add proxy-aware execution context to image generation route — proxy settings are now correctly applied for image providers behind restricted networks (#1904 — thanks @Aculeasis)
+- **fix(translator):** inject `properties: {}` into zero-argument MCP tool schemas during Anthropic→OpenAI translation — prevents 400 errors from OpenAI strict schema validation (#1898 — thanks @bryceIT)
+- **fix(codex):** sanitize raw responses input (#1895 — thanks @dhaern)
+- **fix(combos):** align strategy contracts (#1892 — thanks @dhaern)
+- **fix(combos):** fix combo provider breaker profile handling (#1891 — thanks @rdself)
+- **fix(migrations):** duplicate-column no-op fix (#1886 — thanks @smartenok-ops)
+- **fix(auth):** per-connection OAuth refresh mutex (#1885 — thanks @smartenok-ops)
+- **fix(auth):** require dashboard management auth for compression preview
+
+### 📝 Documentation
+
+- **docs(compression):** document RTK+Caveman stacked savings ranges
+
+### 🏆 Release Attribution & Retroactive Credits
+
+- **@payne0420** (PR #1828 / #1839) — Implementation of the **Rate Limit Watchdog** and environment overrides. (This feature was manually backported to v3.7.8, causing the automatic GitHub Release notes to omit the author's credit).
+
 ---
 
 ## [3.7.8] — 2026-05-01