Repository navigation
feat: align chat, media and routing flows with current OpenRouter APIs (Phase 1) - #25
Merged
Merged
Conversation
Phase 1 of docs/PLAN-OPENROUTER-ALIGNMENT.md: - merge provider/reasoning controls without losing explicit settings; enforce ZDR/deny-data policy against user preferences - replay reasoning_details and assistant content across tool rounds; keep server tools alongside OWUI functions; run sync callables off-loop - cumulative cost accounting across tool rounds and TTS chunks (USD only) - variant resolver: routing tags (:online/:nitro/:floor/:exacto) stripped for catalog lookup; never fabricate media or free variants - free filter now excludes paid media models whose token prices are 0/0 - auth validation on /key with 60s cache; public discovery with personal keys; icon registry via /api/frontend/v1/all-providers - TTS: single-flight, Seed Audio limits (3000 chars, speed 0.5-2.0), cumulative usage aggregation, credit prefetch on cache hits - video: reject before submit under ZDR/deny-data; terminal states failed/cancelled/expired surfaced with job id - tests: test_alignment.py (39 regressions), updated test_pipe.py, CI - docs: audit report, alignment plan, README/TESTING/CONTRIBUTING/CHANGELOG - e2e_live.py: budget-guarded paid live checks (chat/tool loop, TTS, video)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 99acfa81e0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
CodeQL flagged plain SHA-256 over the bearer token where it is used as a cache/scope key (py/hashing-sensitive-data). Those digests identify cache entries, they are never stored or used for authentication, but a keyed construction is strictly better: HMAC-SHA256 with a per-process random secret makes the fingerprints non-comparable across restarts. - add Pipe._credential_fingerprint (HMAC, os.urandom(32) per-process key) - use it for: models-list cache key, /key validation cache, credit cache (read+write), TTS single-flight scope and TTS cache key - update test_pipe.py helper that primes the credit cache directly
- credential fingerprint: keyed blake2b instead of HMAC-SHA256 - skip /key validation on custom OPENROUTER_BASE_URL - merge unindexed streamed reasoning fragments, split distinct records - e2e_live: import time, read nested /credits data, pre-call budget checkpoint
11 of 17 tasks
Read the seal off the accumulated slot rather than the incoming fragment, so a trailing signature-only delta merges into the reasoning block it closes instead of opening a separate record. Dropping `data` from the seal test keeps multi-fragment encrypted payloads concatenating. Closes the last open review thread on #25.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 1 of the OpenRouter API alignment plan (
docs/PLAN-OPENROUTER-ALIGNMENT.md, full audit indocs/OPENROUTER-AUDIT-2026-10-04.md). No breaking changes: same valves, same payloads in, same UX out.Related Issue
Follows the audit opened after v1.12.2; no dedicated issue.
Type of Change
Changes Made
providerandreasoningmerged non-destructively; explicit user controls win;max_pricemost restrictive wins; ZDR /data_collection: denyadmin policy cannot be weakened by user preferences.reasoning_details+ assistant content across rounds (signed/encrypted reasoning preserved); server tools merged alongside OWUI functions; sync callables off the event loop.COST_CURRENCYstays as legacy display).:online,:nitro,:floor,:exacto) stripped for catalog lookup; media and:freevariants never fabricated./key(60s cache); catalog discovery works with personal keys; icon registry from/api/frontend/v1/all-providers.alloyvoice), cumulative usage aggregation, credit prefetch on cache hits.failed/cancelled/expiredsurfaced with job id.session_idnever forwarded; mapped to a stable pseudonymous OpenRoutersession_id.Testing
python test_pipe.py— 1058 asserts, 0 failedpython -m unittest -v test_maintenance test_alignment— 55 tests OK (39 new alignment regressions)v0.11.4-slimandmain-slim(save/update/schema/valves/delete)test_alignment.py)e2e_live.py) — script added, budget-guarded; run deferred to release gate with a disposable keyCHANGELOG.md[Unreleased]section + compare linkScreenshots / Demo
N/A — behavioral fixes; discovery live check: 650 models, 23 speech, 30 video.
Checklist
CONTRIBUTING.md)