[HouMinXi]

What this fixes

This PR addresses shared CI failures first reproduced on release/v3.8.53 at b2a64106c9. The branch is now synchronized with release commit 139070680f77728e2309eb4df18463282a1c990a through a normal merge. The updated head is 4f8237e9d554401e880074978954d847187dd924.

The earlier documentation update added nine lines across .env.example and docs/reference/ENVIRONMENT.md to document OMNIROUTE_MODEL_SYNC_TIMINGS. The two hunks were adapted from #18577 (adff90787fd536b36934cd33b48c7d83c1f00fe1); its broader changes are not included. Timing logs are enabled only by the exact value 1; the wording describes phase outcomes and excludes request, account, catalog and error payloads.

The merged lockfile retains node-forge@1.4.2, @hono/node-server@2.1.5 and UI Kit 0.0.80.

This branch now also includes the two reviewed files from #18711 (78ccd6387082f59f92fd819a7887d652d2769551): the model-sync error logging repair and tests/unit/model-sync-error-helper.test.ts. The route and test blobs match that PR exactly; #18711 remains open and unchanged. Neither PR has been merged. No quality baseline or gate was relaxed.

Documentation counts and 66 translated mirrors

The catalog has 380 providers and 219 SQL migrations; the docs said 377 and 213.

• AGENTS.md, llm.txt: both counts.
• src/shared/constants/agentSkills.ts: the catalog string the two skill files are generated from. This PR also synchronizes the committed generated content for omni-inference, omni-resilience, omni-settings and omni-version-manager, including their changed endpoint references, to clear check:agent-skills-sync.
• docs/i18n/*/llm.txt: all 66 mirrors, which check:docs-sync compares against the root file.

SSO direct-run guard

scripts/cli/omniroute-sso.mjs gated its entry point on

if (import.meta.url === `file://${process.argv[1]}`) {

That never matches on Windows: import.meta.url is file:///C:/… while argv[1] is C:\…. The script exited 0 having done nothing, which could look like a successful run without exercising the entry point. It uses pathToFileURL(process.argv[1] || "").href now, the form the other scripts in scripts/ already use.

Two API-route diagnostics

• AntigravityQuotaFamily gained argon, but getAntigravityFamilyCooldownUntil still declared only gemini/claude/other. The reader's parameter type now matches the family resolver; its existing runtime lookup already indexed the supplied family.
• Argon restart rehydration is a separate runtime fix in #18663, not included here. Both PRs include the reader parameter-type correction; this PR does not change the rehydration family list or family-lock sentinel.
• Eleven catalog entries carry a codeBlock.title that the schema never declared. The schema now includes the optional field so the serialized catalog retains it.

Historical vulnerability scan

The original validation recorded a vulnerability count of 30 against a baseline of 27, then 18 after the lockfile update from node-forge@1.4.0 to 1.4.2. These are historical results, not a fresh scan of the current head. The current OSV result must be established by CI.

check:lockfile

The node-forge upgrade above wrote a mirror's tarball host into the lockfile. The integrity hash is the official registry's, so only the resolved URL changes back.

UI timer cleanup

The original UI run passed 604/604 test files but failed on an uncaught ReferenceError: window is not defined raised from ComboDefaultsTab.tsx:205. That component starts a 2.5 s status timer with no handle to clear it, so a save landing just before unmount fires setState into a torn-down tree. The timer is tracked now and cleared on unmount and between successive messages.

Verification

Historical results from the original changes based on b2a64106c9 (not a rerun of the current head):

Gate	Before	After
check:docs-counts	7 strict drifts, exit 1	exit 0, 2 soft warnings
check:docs-all	docs-sync FAIL on docs/i18n/*/llm.txt	exit 0
scripts-direct-run-guard	1 of 2 failing	2/2
check:api-typecheck	2 new diagnostics, exit 1	exit 0
check:vuln-ratchet --ratchet	30 > 27, exit 1	18 ≤ 27, exit 0
check:agent-skills-sync	4 skills stale	Generated: 0
check:provider-asset-provenance	auditedCommit object absent in a CI clone	144 registered assets checked against b19031110b; provenance classifications remain 72 proven, 69 probable and 3 unresolved
check:lockfile	mirror tarball host, exit 1	exit 0
check:dashboard-typecheck	—	exit 0

scripts/cli/omniroute-sso.mjs still prints its usage when run directly, and importing it does not run main().

Provider-count regression test

tests/unit/agent-skills-provider-count.test.ts compares the provider count in the catalog descriptions and in the two generated skill files against the same provider union the docs gate computes. The original validation deliberately restored the stale count in each source:

• catalog 380-provider → 377-provider: description must say 380 providers, found: omni-providers: "377-provider" (1 failed).
• skills/omni-providers/SKILL.md → 377-provider: generated skills must say 380 providers (1 failed).

After restoring the fix, both tests passed.

Argon verification scope

The Argon restart-restoration tests and the previously listed 53/53 and 5/5 results are not evidence for this PR's current diff. Restart-restoration implementation and verification are tracked separately in #18663.

The original validation recorded passing lint, core typecheck, API typecheck, complexity and mutation-test coverage checks. The strict no-implicit-any check reported the same 15 pre-existing TS7006 diagnostics in untouched open-sse/config/imageRegistry.ts before and after the original fix; no baseline was relaxed. Full unit, Vitest, coverage, and build suites were not rerun locally for this follow-up.

Documentation update validation

Five-lens review and a targeted environment-doc check passed. The checker used both complete documentation files and scanned only the timing module, so this does not establish that the full-repository docs check passes. Tests covered ten environment values, success/error identity, payload exclusion and a failing diagnostic sink.

Both documentation file blobs match the reviewed candidates. A full local checkout, lint and hooks were unavailable for that update. A scheduled OSV step that skipped because its binary was absent is not evidence of a clean scan.

Combined error-helper validation

CI on the preceding head, b2bdc896, completed with error-helper as the only blocking root cause. The patch calls saveCallLog directly inside timings.measure, preserves the HTTP sanitizer and checker rules, and adds five regression tests covering internal logging and raw HTTP error controls. It passed independent five-lens review and focused checks. Before applying it, the target route matched the patch's original input and the test path was absent. All 89 previously changed file blobs are unchanged.

Fresh CI for combined head 4f8237e9d554401e880074978954d847187dd924 is pending. The preceding head's passing checks do not verify this new head. A full local checkout, lint and hooks were also unavailable for this integration.

[CompleteDotTech]

Independent confirmation for the two API Route Typecheck failures in this PR: on a fresh Ubuntu VM at exact base b2a64106c9e47d654012d24d5ae5424c950649cc, the gate fails on availabilityRouterFilters.ts TS2345 and cliTools.ts TS2353. A local minimal repair clears both without editing the frozen baseline (244 pre-existing diagnostics remain within it). This is confirmation of the failure sites, not a claim that I ran your entire head. I am keeping the overlapping type repair out of Rosebud PR #18577.

One related follow-up: rehydrateAntigravityFamilyLocks still iterates only Gemini/Claude, and dummyModelForFamily excludes Argon. Accepting Argon in the reader fixes the type contract, but saved Argon cooldowns still need restoring after restart. I tested extending the rehydration list to include argon, using Exclude<AntigravityQuotaFamily, "other"> for the dummy-model helper, and generating ${family}-family-lock. The regression checks both provider aliases restore family:argon, preserve the deadline, leave Gemini/Claude clear, and ignore expiry. The focused repair suite passed 31/31 in that VM. No paid/provider calls or production changes.

Prior work: compared this PR with draft #18576, which also covers the reader/schema mismatch. No competing type-repair PR will be opened. The unrelated Windows test-fixture portability repairs are being kept separate.

[HouMinXi]

Updated verification: 2026-11-01 12:02 UTC

This supersedes the 06:13 status below: #18658 is now synchronized with release/v3.8.53 at 139070680f77728e2309eb4df18463282a1c990a, with head 4f8237e9d554401e880074978954d847187dd924. The environment-documentation hunks were adapted from #18577, and the two reviewed error-helper files from #18711 are now included byte-for-byte. #18711 remains open and unchanged; neither PR has been merged.

The latest completed CI, Quality Gates, API Route Typecheck and semgrep runs all passed. Logs confirm the tested merge fe29eab5 combines this head with release 139070680.

• Build, Vitest, all eight unit shards, Coverage and both aggregate gates passed. The five new error-helper regressions and seven existing model-sync timing tests ran and passed.
• check:error-helper passed with 1,405 files scanned and the same 18 frozen exceptions. Docs, generated skills, lockfile and provenance gates passed; the provenance classifications remain 72 proven, 69 probable and 3 unresolved across 144 registered assets.
• OSV found 17 vulnerabilities: 8 high, 8 moderate and 1 low, below the unchanged baseline of 27.
• Coverage: statements/lines 86.22%, branches 82.92%, functions 90.19%. E2E, integration and package jobs were skipped by workflow policy. Earlier same-head runs canceled after the description update and their failed aggregate records remain in the history; the latest aggregate gates passed.

The original 89 changed file blobs were preserved when the two error-helper files were added. The lockfile retains node-forge 1.4.2, @hono/node-server 2.1.5 and UI Kit 0.0.80. A full local checkout, lint and hooks remained unavailable for these follow-ups. The results above come from hosted CI.

GitHub reports the PR as mergeable with a clean state. No submitted reviews are recorded, so maintainer review is still needed. These results do not establish that #17219 can be closed. Argon restart restoration remains separate in #18663.

Historical verification, superseded by the update above

Addresses baseline failures tracked in #17219, without claiming that the tracker can be closed.

I corrected two description errors: generated skill synchronization is included; Argon restart restoration and its previously quoted test counts belong to #18663, not this diff. The reader-type correction overlaps both PRs. No source or gate baseline changed.

Refs checked 2026-11-01 06:13 UTC:

• Head: 2b335387b497781aadd0cc4ffb7a5c0d91200de1.
• Latest release tip: 139070680f77728e2309eb4df18463282a1c990a; original merge base: b2a64106c9e47d654012d24d5ae5424c950649cc (15 commits behind).
• Local composition: 209922b82efd32282a39cc1cd34687f2027af4a4 (tree, not a pushed commit). Merge-tree and whitespace checks passed. The lockfile preserves node-forge 1.4.2, @hono/node-server 2.1.5 and UI Kit 0.0.80.

On that composed tree with Node 24.22.1, 25 focused tests passed (provider-count, SSO script, catalog schema/display); title roundtrip/type-rejection and SSO space/#-path probes passed. Strict mutation mappings passed; provenance gate passed (144 registered: 72 proven, 69 probable, 3 unresolved); docs counts exited 0 with two soft warnings. This reused installed dependencies, including @hono/node-server 2.0.11 rather than locked 2.1.5: it is not fresh-install or full-CI evidence. Live SSO, audit, build, UI and full suites were not rerun. The existing async-unmount timer edge case still lacks focused runtime coverage.

Hosted CI outcome (2026-11-01 06:13 UTC)

The new CI and Quality runs both completed with failure. Logs confirm checkout 709b3425d87f2ca40940a16f99a0f7517e345e3b (head above + base 3d2349326cfc2f56f7ea70d7e1165779b9beb0b1), excluding latest release 139070680. These runs cannot establish latest-tip integration readiness.

Two new base issues trace to upstream #18466 / f623766f, after this PR's original base:

• Docs Sync / Docs Gates: OMNIROUTE_MODEL_SYNC_TIMINGS is missing from env documentation; the same missing variable also fails unit shards 4 and 8. #18577 already contains the two-file documentation fix; its broader Rosebud scope is not part of this review. Please coordinate or extract those documentation hunks rather than duplicate the repair.
• Lint / check:error-helper: the gate no longer recognizes the saveTimedCallLog wrapper as an internal logging sink. The same error-helper gate also fails Fast Quality. The static checker is clean on this PR head and flags the latest release source; the wrapper still delegates to sanitized logging and the HTTP response retains sanitization. This is evidence of a gate compatibility regression, not a demonstrated client-data leak. A narrow repair could retain a direct saveCallLog inside timings.measure, with positive/negative scanner fixtures rather than a broad allowlist.

Build, Vitest, Security, Merge Integrity, Quality Ratchet and the other six unit shards passed. No new API Route Typecheck or Semgrep run was triggered; their October 31 results remain historical.

No source or gate changes were made here. Please review the baseline-repair scope and coordinate these upstream blockers; this is not a merge-ready claim.

[HouMinXi]

The two-test reload-timer cleanup is in 6be0be48a95cefe9d5d15b88aff0b1960b012aa7; production navigation is unchanged. The UI job passed with 4,068 UI tests and one skip, including all 32 targeted tests, with no unhandled errors.

CI is still red because Unit Tests (2/8) crashed with System.IO.IOException: No space left on device while writing the runner diagnostic log. That shard's test result is unknown. The other seven shards and all other executed validation jobs passed, including Build and Quality Ratchet; the separate Quality Gates, API Route Typecheck and Semgrep workflows also passed. The aggregate CI gate failed as a consequence. Skipped integration, E2E and packaging jobs are not counted as passes.

Could a maintainer select Re-run failed jobs on run 41367965342? I tried the failed-jobs retry once, but my account has no write permission on the upstream repository, and the retry was rejected. No new attempt started.