Merge release/v3.8.8 into main

[diegosouzapw]

Summary

Promotes the active release line v3.8.8 to main (709 commits ahead). Release is a superset of main's features (Trae, Notion MCP, SiliconFlow, OOM fixes, MaintenanceBanner), so the ~44 content conflicts were resolved to the release version; generated .source/* files (gitignored) were dropped.

Conflict resolution

• Conflicts → release version (release is the superset / promotion source).
• main-only content preserved (auto-merged, not in conflict): ProviderQuotaWidget (fix(home): pass providerId to quota widget icons #3064), combos/page.tsx, and 2 main-only tests. Verified the merge differs from release/v3.8.8 in only these items.

Post-merge reconciliation (commit fix: post-merge reconciliation)

• CHANGELOG.md: restored release's authoritative changelog (auto-merge had re-introduced main's stale Unreleased section).
• src/sse/services/auth.ts: ported fix(combo): align custom provider ids across creation and auth lookup #3058 — getProviderSearchPool expands custom provider_nodes prefixes (e.g. 78code/gpt-5.4) to internal connection ids during credential lookup; release lacked this fix. nvidia alias special-casing preserved.
• tests/unit/quota-plan-registry.test.ts: aligned knownProviders() count 6 → 10 (registry gained claude/deepseek/kimi-coding/xiaomi-mimo). Pre-existing stale assertion on release.

Validation (local, clean npm ci)

• ✅ lint (0 errors), check:route-validation:t06, check:any-budget:t11, check:docs-sync, check:cycles, check:node-runtime
• ✅ typecheck:core, npm run build
• ✅ unit suite green (real failures fixed; remaining flakiness is the pre-existing quota/chatCore concurrency artifact under --test-force-exit, which passes in isolation)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b0bd9d7d6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle absent plugin status filters

When GET /api/plugins is called without a status query parameter, URLSearchParams.get() returns null, but StatusSchema is only optional for undefined. This makes the default unfiltered plugin list return 400, which breaks the main plugins page/list API unless callers always add a status filter.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Use the actual response in onResponse hooks

For successful chat requests with response-modifying plugins enabled, this new hook call passes only { status: 200 } and discards the runOnResponse return value. Since the plugin API supports onResponse(ctx, response) transformations, plugins that inspect or replace the completion payload never see the actual response and any returned modification is ignored in the chat success path.

Useful? React with 👍 / 👎.

[gemini-code-assist]

Code Review

This pull request bumps the version to 3.8.8 and introduces a robust plugins framework, including structured error handling, rate limiting, and dev-mode hot-reloading. It also implements a Quota Share Engine, session pool fingerprint rotation for DuckDuckGo Web, and auto-calibration for the V8 heap-pressure guard. Feedback on these changes highlights several critical issues: request-scoped metadata is lost across plugin hooks due to block scoping in chatCore.ts; the absolute path validation regex breaks Windows compatibility; unprefixed model IDs block public model checks; redundant status checks create dead code in the DuckDuckGo executor; directory traversal checks are bypassed by path resolution; clearing number inputs in the plugin config page incorrectly defaults to zero; fetch error handling in the plugins page fails to catch non-2xx responses; and rate-limit logging can flood application logs.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The pluginCtx object is block-scoped to the try block of the onRequest hook. Any metadata merged into pluginCtx.metadata via Object.assign is lost once the block exits. Consequently, subsequent hooks like runOnError (line 3423) and runOnResponse (line 5847) receive a fresh, empty metadata: {} object, preventing plugins from sharing state across different phases of the request lifecycle.

To fix this, declare a request-scoped pluginMetadata object at the top of handleChatCore and pass it to all hook invocations.

[gemini-code-assist]

The regex ^\/ strictly requires the path to start with /, which will reject valid Windows absolute paths (e.g., C:\path\to\plugin). Since the project supports Windows, this Unix-only check will break plugin installation on Windows.

Suggested change

	path: z.string().min(1).regex(/^\/[^]*$/, "Path must be absolute").refine(
	(p) => !p.includes("\0") && !p.includes(".."),
	"Path must not contain traversal patterns or null bytes"
	),
	path: z.string().min(1).refine((p) => p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p), "Path must be absolute").refine(
	(p) => !p.includes("\0") && !p.includes(".."),
	"Path must not contain traversal patterns or null bytes"
	),

[gemini-code-assist]

If a request is made with an unprefixed model ID (e.g., "gpt-4"), splitting by / results in providerId = "gpt-4" and shortModelId = "". This will fail to find the model in the provider catalog and return false, blocking valid requests. Unprefixed model IDs must be resolved to their canonical prefixed form before performing this check.

[gemini-code-assist]

The statuses 429 and >= 500 are already handled by early returns at lines 128 and 162. Therefore, the code inside if (pool && session) at lines 173-181 will only ever execute the else branch (pool.reportSuccess(session)). The checks for 429 and >= 500 are dead code.

      // Report pool status based on response
      if (pool && session) {
        pool.reportSuccess(session);
      }

[gemini-code-assist]

resolve resolves relative segments like .. and . to their absolute paths before normalized.includes("..") is checked. For example, /foo/bar/../baz resolves to /foo/baz, which does not contain ... Thus, checking normalized.includes("..") after resolution is ineffective at detecting traversal attempts. The check should be performed on the raw input path before resolution.

function validatePluginPath(path: string): string {
  // Reject null bytes
  if (path.includes("\0")) {
    throw new Error("Invalid path: contains null bytes");
  }
  // Reject directory traversal attempts in the input path
  if (path.includes("..") || path.includes("~")) {
    throw new Error("Invalid path: directory traversal detected");
  }
  // Must be absolute
  if (!isAbsolute(path)) {
    throw new Error("Path must be absolute");
  }
  return normalize(resolve(path));
}

[gemini-code-assist]

When the user clears a number input field, e.target.value becomes "". Coercing this with Number(e.target.value) results in 0, which immediately populates the field with 0 instead of leaving it empty. This can be annoying for users trying to type a new number or clear an optional field.

Suggested change

	) : field.type === "number" ? (
	<input
	type="number"
	value={Number(value)}
	min={field.min}
	max={field.max}
	onChange={(e) => handleChange(key, Number(e.target.value))}
	className="w-full rounded border p-2"
	/>
	) : field.type === "number" ? (
	<input
	type="number"
	value={value === "" ? "" : Number(value)}
	min={field.min}
	max={field.max}
	onChange={(e) => handleChange(key, e.target.value === "" ? "" : Number(e.target.value))}
	className="w-full rounded border p-2"
	/>

[gemini-code-assist]

fetch does not throw an error on non-2xx HTTP status codes (like 400 or 500). If the server fails to activate/deactivate a plugin, res.ok will be false, but the catch block won't be triggered. As a result, no error notification will be shown to the user.

  const handleToggle = async (name: string, enable: boolean) => {
    const endpoint = enable ? "activate" : "deactivate";
    try {
      const res = await fetch(`/api/plugins/${name}/${endpoint}`, { method: "POST" });
      if (!res.ok) throw new Error();
      addNotification({ type: "success", message: enable ? t("activated", { name }) : t("deactivated", { name }) });
      await fetchPlugins();
    } catch {
      addNotification({ type: "error", message: enable ? t("activateFailed", { name }) : t("deactivateFailed", { name }) });
    }
  };

[gemini-code-assist]

Logging a warning for every single rate-limited hook call can flood the application logs and degrade performance if a plugin is misbehaving and making thousands of calls. Consider changing the log level to debug or debouncing the warning.

Suggested change

	if (isRateLimited(reg.pluginName)) {
	log.warn("hook.rate_limited", { event, pluginName: reg.pluginName });
	continue;
	}
	if (isRateLimited(reg.pluginName)) {
	log.debug("hook.rate_limited", { event, pluginName: reg.pluginName });
	continue;
	}

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This PR promotes release/v3.8.8 to main (709 commits). The changes include:

• Deleted .source/browser.ts and .source/server.ts (generated files, correctly removed)
• .env.example updates: new env var documentation for PII window size, Trae settings, heap pressure, plugin exec, and trace flags
• Test fixes for sidebar costs section (costs-quota-plans retired, costs-quota-share moved to HIDEABLE list)
• New streaming PII transform tests for event name preservation and IPv6 handling
• Thinking budget tests for model suffix handling and passthrough mode
• Token limit counter tests, token refresh tests
• Usage utils tests including ReDoS guard for subscription tier mapping
• T23/T24 fallback resilience tests with improved type annotations

All changes are consistent with the release changelog and follow existing code patterns. No inline code changes require comments. The merge uses release version for conflict resolution as documented.

Files Reviewed (22 files)

• .env.example — env var documentation
• tests/unit/sidebar-*.test.ts — sidebar item tests (6 changes)
• tests/unit/streamingPiiTransform.test.ts — new PII event handling tests
• tests/unit/service-thinking-budget.test.ts — new thinking budget tests
• tests/unit/service-token-*.test.ts — new token service tests
• tests/unit/usage-utils.test.ts — new ReDoS guard test
• tests/unit/t23-t24-fallback-resilience.test.ts — test improvements
• docs/i18n/*/CHANGELOG.md — i18n changelog updates (40+ files)
• docs/architecture/ARCHITECTURE.md — provider/executor counts updated
• .agents/skills/deploy-*.md — deployment script updates

---

_{Reviewed by laguna-m.1-20260312:free · 3,242,445 tokens}

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.

[diegosouzapw]

Redundante — a promoção release/v3.8.8 → main já é a PR #2930. Os fixes (resolução de conflitos, port do #3058, alinhamento de testes e reparo do CI) vão direto na release/v3.8.8 (head da #2930).