Sync upstream v7.2.73 → v7.2.140 (retire Patch 3, keep Patches 1/2/4)

.gitignore

@@ -8,7 +8,7 @@ config.yaml
 
 # Generated content
 bin/*
-logs/*
+/logs
 conv/*
 temp/*
 refs/*
@@ -33,6 +33,7 @@ docs/*
 AGENTS.md
 CLAUDE.md
 GEMINI.md
+AGENTS.override.md
 
 # Tooling metadata
 .vscode/*
@@ -44,15 +45,24 @@ GEMINI.md
 .serena/*
 .agent/*
 .agents
+.pi
 .agents/*
 .opencode/*
 .idea/*
 .beads/*
 .bmad/*
 _bmad/*
 _bmad-output/*
+.gocache/
+.gitnexus/
 
 # macOS
 .DS_Store
 ._*
-.gocache/
+
+# docker
+docker-compose.override.yml
+
+
+# Local LLM Wiki vault
+.llm-wiki

README.md

@@ -18,11 +18,9 @@ When `reasoning_content` is absent or empty in the upstream response, fall back
 
 Remove `cache_control` from `messages[].content[]`, `system[]`, `tools[]`, and message-level fields before translation.
 
-### Patch 3 — OAuth access tokens use `Authorization: Bearer …` (Claude executor auth)
+### Patch 3 — RETIRED (upstream since v7.2.140, deployment uses OAuth files)
 
-`internal/runtime/executor/claude_executor.go` (two call sites: `PrepareRequest` and `applyClaudeHeaders`).
-
-When the credential's API key starts with `sk-ant-oat01-`, route via `Authorization: Bearer …` instead of `x-api-key`. Real `sk-ant-api03-*` API keys keep the existing `x-api-key` routing.
+Previously: OAuth access tokens (`sk-ant-oat01-*`) stored in `claude-api-key:` entries were routed via `Authorization: Bearer …` instead of `x-api-key`. Retired in the v7.2.140 sync because (a) upstream now detects OAuth tokens natively (`isClaudeOAuthToken` in `internal/runtime/executor/claude_executor_request.go` forces Bearer on the request path), and (b) the AMPECO deployment migrated from `claude-api-key:` token entries to OAuth credential files (`--claude-login`), so the api-key code path no longer carries OAuth tokens at all.
 
 ### Patch 4 — strip Claude entries from the `antigravity` model catalog
 
@@ -35,9 +33,8 @@ Strip every entry whose `id` starts with `claude-`, whose `type` is `claude`, or
 ## Tests
 
 ```bash
-go test ./internal/translator/openai/claude/...                                                     # Patches 1 + 2
-go test ./internal/runtime/executor/ -run 'OAuthAccessTokenUsesBearerAuth|ApiKeyStillUsesXApiKey'   # Patch 3
-go test ./internal/registry/...                                                                     # Patch 4 (catalog integrity)
+go test ./internal/translator/openai/claude/...   # Patches 1 + 2
+go test ./internal/registry/...                    # Patch 4 (catalog integrity)
 ```
 
 ## Rebase

cmd/server/main.go

@@ -37,6 +37,7 @@ import (
 	"github.com/router-for-me/CLIProxyAPI/v7/internal/util"
 	sdkAuth "github.com/router-for-me/CLIProxyAPI/v7/sdk/auth"
 	coreauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth"
+	sdkpluginstore "github.com/router-for-me/CLIProxyAPI/v7/sdk/pluginstore"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -152,6 +153,7 @@ func main() {
 	var configLoadedFromHome bool
 	var homeClient *home.Client
 	var homePluginSyncReport homeplugins.SyncReport
+	var homePluginStatusReady bool
 	var (
 		usePostgresStore     bool
 		pgStoreDSN           string
@@ -282,7 +284,11 @@ func main() {
 			homeCfg.DisableClusterDiscovery = true
 		}
 		homeClient = home.New(homeCfg)
-		defer homeClient.Close()
+		defer func() {
+			if homeClient != nil {
+				homeClient.Close()
+			}
+		}()
 
 		ctxHomeConfig, cancelHomeConfig := context.WithTimeout(context.Background(), 30*time.Second)
 		raw, errGetConfig := homeClient.GetConfig(ctxHomeConfig)
@@ -303,16 +309,53 @@ func main() {
 		parsed.Home = homeCfg
 		parsed.Port = 8317 // Default to 8317 for home mode, can be overridden by home config
 		parsed.UsageStatisticsEnabled = true
-		ctxHomePlugins, cancelHomePlugins := context.WithTimeout(context.Background(), 30*time.Second)
+		pluginSyncCfg := *parsed
+		parsed.Plugins.StoreAuth = nil
 		var errHomePlugins error
-		homePluginSyncReport, errHomePlugins = homeplugins.SyncWithReport(ctxHomePlugins, parsed, pluginHost)
-		cancelHomePlugins()
-		errReportPlugins := home.ReportPluginStatus(context.Background(), homeClient, homeCfg.NodeID, homePluginSyncReport)
+		platform := homeplugins.CurrentPlatform()
+		if pluginSyncCfg.Plugins.Enabled {
+			ctxHomePlugins, cancelHomePlugins := context.WithTimeout(context.Background(), 30*time.Second)
+			installedVersions, errInstalledPlugins := homeplugins.InstalledVersions(&pluginSyncCfg)
+			if errInstalledPlugins != nil {
+				homePluginStatusReady = true
+				errHomePlugins = errInstalledPlugins
+				homePluginSyncReport = homeplugins.CompletedSyncReport(platform, errInstalledPlugins)
+			} else {
+				pluginSyncRequest := sdkpluginstore.PluginSyncRequest{
+					SchemaVersion:     sdkpluginstore.PluginSyncSchemaVersion,
+					GOOS:              platform.GOOS,
+					GOARCH:            platform.GOARCH,
+					InstalledVersions: installedVersions,
+				}
+				pluginSyncResponse, errFetchPlugins := homeClient.GetPluginSync(ctxHomePlugins, pluginSyncRequest)
+				errHomePlugins = errFetchPlugins
+				switch {
+				case errHomePlugins == nil:
+					homePluginStatusReady = true
+					homePluginSyncReport, errHomePlugins = homeplugins.SyncResolvedWithReport(ctxHomePlugins, &pluginSyncCfg, pluginSyncResponse.Items, pluginSyncResponse.ExpiresAt, pluginSyncRequest.InstalledVersions, pluginHost)
+				case errors.Is(errHomePlugins, home.ErrPluginSyncUnsupported):
+					homePluginStatusReady = true
+					homePluginSyncReport, errHomePlugins = homeplugins.SyncWithReport(ctxHomePlugins, &pluginSyncCfg, pluginHost)
+				default:
+					homePluginStatusReady = true
+					homePluginSyncReport = homeplugins.CompletedSyncReport(platform, errHomePlugins)
+				}
+				pluginSyncRequest.Clear()
+				pluginSyncResponse.Clear()
+			}
+			cancelHomePlugins()
+		} else {
+			homePluginStatusReady = true
+			homePluginSyncReport = homeplugins.CompletedSyncReport(platform, nil)
+		}
 		if errHomePlugins != nil {
-			log.Errorf("failed to fetch plugins from home: %v", errHomePlugins)
+			log.Errorf("failed to sync plugins from home: %v", errHomePlugins)
 		}
-		if errReportPlugins != nil {
-			log.Warnf("failed to report home plugin sync status: %v", errReportPlugins)
+		if homePluginStatusReady {
+			errReportPlugins := home.ReportPluginStatus(context.Background(), homeClient, homeCfg.NodeID, homePluginSyncReport)
+			if errReportPlugins != nil {
+				log.Warnf("failed to report home plugin sync status: %v", errReportPlugins)
+			}
 		}
 		if errHomePlugins != nil {
 			return
@@ -570,7 +613,7 @@ func main() {
 	// Register built-in access providers before constructing services.
 	configaccess.Register(&cfg.SDKConfig)
 	pluginHost.ApplyConfig(context.Background(), cfg)
-	if configLoadedFromHome {
+	if configLoadedFromHome && homePluginStatusReady {
 		errHomePluginLoad := homeplugins.MarkLoadResults(&homePluginSyncReport, pluginHost)
 		errReportPlugins := home.ReportPluginStatus(context.Background(), homeClient, cfg.Home.NodeID, homePluginSyncReport)
 		if errHomePluginLoad != nil {
@@ -583,6 +626,12 @@ func main() {
 			return
 		}
 	}
+	if homeClient != nil {
+		// The bootstrap client is not owned by the runtime service. Close it after
+		// the final startup report so it cannot retain an idle RESP connection.
+		homeClient.Close()
+		homeClient = nil
+	}
 	if pluginHost.HasTriggeredCommandLineFlags() {
 		if exitCode, handled := pluginHost.ExecuteCommandLine(context.Background(), os.Args[0], os.Args[1:], configFilePath, flag.CommandLine); handled {
 			if exitCode != 0 {